chore: merge rename commit into Plan 1B branch
Resolves conflicts from merging origin/main (idfoto→relicario rename): - Kept Plan 1A's typed-item vault.rs, lib.rs, integration.rs over main's old entry-based versions - Took main's relicario_dir() fix in CLI main.rs (sed had missed idfoto_dir) - Kept Plan 1A's UnsupportedFormatVersion error variant in crypto.rs - Kept Plan 1A's opaque Decrypt message (audit M4) in error.rs - Deleted entry.rs (replaced by item.rs + typed modules in Plan 1A) - Resolved Cargo.toml description to main's "relicario password manager" Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
adlee-was-taken
18
CLAUDE.md
18
CLAUDE.md
@@ -1,15 +1,15 @@
|
||||
# CLAUDE.md — idfoto
|
||||
# CLAUDE.md — relicario
|
||||
|
||||
## What is this
|
||||
|
||||
idfoto is a git-backed, self-hostable password manager with a Rust core. Two-factor vault decryption: passphrase + a reference JPEG carrying a 256-bit secret embedded via DCT steganography. The server only ever sees opaque ciphertext.
|
||||
relicario is a git-backed, self-hostable password manager with a Rust core. Two-factor vault decryption: passphrase + a reference JPEG carrying a 256-bit secret embedded via DCT steganography. The server only ever sees opaque ciphertext.
|
||||
|
||||
## Build and test
|
||||
|
||||
```bash
|
||||
cargo build # build everything
|
||||
cargo test # run all tests (unit + integration)
|
||||
cargo test -p idfoto-core # core library tests only
|
||||
cargo test -p relicario-core # core library tests only
|
||||
cargo run -- --help # CLI help
|
||||
cargo run -- generate -l 32 # quick smoke test
|
||||
```
|
||||
@@ -18,24 +18,24 @@ cargo run -- generate -l 32 # quick smoke test
|
||||
|
||||
```
|
||||
crates/
|
||||
├── idfoto-core/ # Platform-agnostic library (no filesystem, no git, no network)
|
||||
├── relicario-core/ # Platform-agnostic library (no filesystem, no git, no network)
|
||||
│ ├── src/
|
||||
│ │ ├── lib.rs # Re-exports public API
|
||||
│ │ ├── error.rs # IdfotoError enum (thiserror)
|
||||
│ │ ├── error.rs # RelicarioError enum (thiserror)
|
||||
│ │ ├── crypto.rs # Argon2id KDF + XChaCha20-Poly1305 encrypt/decrypt
|
||||
│ │ ├── entry.rs # Entry, ManifestEntry, Manifest structs (serde)
|
||||
│ │ ├── vault.rs # encrypt_entry, decrypt_entry, encrypt_manifest, decrypt_manifest
|
||||
│ │ └── imgsecret.rs # DCT-based 256-bit secret embedding in JPEGs
|
||||
│ └── tests/
|
||||
│ └── integration.rs # Full-workflow and two-factor independence tests
|
||||
└── idfoto-cli/ # CLI binary
|
||||
└── relicario-cli/ # CLI binary
|
||||
└── src/
|
||||
└── main.rs # clap CLI: init, add, get, list, edit, rm, sync, generate, device
|
||||
```
|
||||
|
||||
## Key design decisions
|
||||
|
||||
- **idfoto-core is bytes-in/bytes-out.** No filesystem, no network, no git operations. Makes it portable to WASM, Android, iOS.
|
||||
- **relicario-core is bytes-in/bytes-out.** No filesystem, no network, no git operations. Makes it portable to WASM, Android, iOS.
|
||||
- **XChaCha20-Poly1305** over AES-GCM — 192-bit nonce eliminates collision risk, fast in WASM/ARM without AES-NI.
|
||||
- **Single master_key** (no per-entry subkeys) — simpler, sufficient for family vault sizes.
|
||||
- **imgsecret uses central-embed DCT** — embeds only in the middle 70% of the image (15% crumple zone for crop tolerance), with majority voting across 5-50 redundant copies.
|
||||
@@ -62,11 +62,11 @@ passphrase (UTF-8 bytes) || image_secret (32 bytes from reference JPEG)
|
||||
|
||||
## Remote
|
||||
|
||||
Source code: `ssh://git@git.adlee.work:2222/alee/idfoto.git`
|
||||
Source code: `ssh://git@git.adlee.work:2222/alee/relicario.git`
|
||||
|
||||
## Design spec
|
||||
|
||||
Full threat model, entropy analysis, and architecture: `docs/superpowers/specs/2026-04-11-idfoto-design.md`
|
||||
Full threat model, entropy analysis, and architecture: `docs/superpowers/specs/2026-04-11-relicario-design.md`
|
||||
|
||||
## Roadmap
|
||||
|
||||
|
||||
607
Cargo.lock
generated
607
Cargo.lock
generated
@@ -18,24 +18,6 @@ dependencies = [
|
||||
"generic-array",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "aho-corasick"
|
||||
version = "1.1.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
|
||||
dependencies = [
|
||||
"memchr",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "android_system_properties"
|
||||
version = "0.1.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
|
||||
dependencies = [
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "anstream"
|
||||
version = "1.0.0"
|
||||
@@ -124,12 +106,6 @@ dependencies = [
|
||||
"password-hash",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "arrayvec"
|
||||
version = "0.7.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
|
||||
|
||||
[[package]]
|
||||
name = "async-trait"
|
||||
version = "0.1.89"
|
||||
@@ -153,41 +129,6 @@ version = "1.8.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
|
||||
|
||||
[[package]]
|
||||
name = "bip39"
|
||||
version = "2.2.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "90dbd31c98227229239363921e60fcf5e558e43ec69094d46fc4996f08d1d5bc"
|
||||
dependencies = [
|
||||
"bitcoin_hashes",
|
||||
"serde",
|
||||
"unicode-normalization",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "bit-set"
|
||||
version = "0.5.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
|
||||
dependencies = [
|
||||
"bit-vec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "bit-vec"
|
||||
version = "0.6.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
|
||||
|
||||
[[package]]
|
||||
name = "bitcoin_hashes"
|
||||
version = "0.14.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "26ec84b80c482df901772e931a9a681e26a1b9ee2302edeff23cb30328745c8b"
|
||||
dependencies = [
|
||||
"hex-conservative",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "bitflags"
|
||||
version = "2.11.0"
|
||||
@@ -276,20 +217,6 @@ dependencies = [
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "chrono"
|
||||
version = "0.4.44"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
|
||||
dependencies = [
|
||||
"iana-time-zone",
|
||||
"js-sys",
|
||||
"num-traits",
|
||||
"serde",
|
||||
"wasm-bindgen",
|
||||
"windows-link",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "cipher"
|
||||
version = "0.4.4"
|
||||
@@ -362,12 +289,6 @@ version = "0.9.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
|
||||
|
||||
[[package]]
|
||||
name = "core-foundation-sys"
|
||||
version = "0.8.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
|
||||
|
||||
[[package]]
|
||||
name = "cpufeatures"
|
||||
version = "0.2.17"
|
||||
@@ -446,15 +367,6 @@ dependencies = [
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "deranged"
|
||||
version = "0.5.8"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
|
||||
dependencies = [
|
||||
"powerfmt",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "digest"
|
||||
version = "0.10.7"
|
||||
@@ -497,17 +409,6 @@ dependencies = [
|
||||
"objc2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "displaydoc"
|
||||
version = "0.2.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "ed25519"
|
||||
version = "2.2.3"
|
||||
@@ -533,12 +434,6 @@ dependencies = [
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "either"
|
||||
version = "1.15.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
|
||||
|
||||
[[package]]
|
||||
name = "errno"
|
||||
version = "0.3.14"
|
||||
@@ -555,17 +450,6 @@ version = "3.3.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"
|
||||
|
||||
[[package]]
|
||||
name = "fancy-regex"
|
||||
version = "0.13.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "531e46835a22af56d1e3b66f04844bed63158bc094a628bec1d321d9b4c44bf2"
|
||||
dependencies = [
|
||||
"bit-set",
|
||||
"regex-automata",
|
||||
"regex-syntax",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "fax"
|
||||
version = "0.2.6"
|
||||
@@ -617,15 +501,6 @@ dependencies = [
|
||||
"miniz_oxide",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "form_urlencoded"
|
||||
version = "1.2.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
|
||||
dependencies = [
|
||||
"percent-encoding",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "futures-core"
|
||||
version = "0.3.32"
|
||||
@@ -706,15 +581,6 @@ version = "0.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
|
||||
|
||||
[[package]]
|
||||
name = "hex-conservative"
|
||||
version = "0.2.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "fda06d18ac606267c40c04e41b9947729bf8b9efe74bd4e82b61a5f26a510b9f"
|
||||
dependencies = [
|
||||
"arrayvec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "hmac"
|
||||
version = "0.12.1"
|
||||
@@ -724,133 +590,6 @@ dependencies = [
|
||||
"digest",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "iana-time-zone"
|
||||
version = "0.1.65"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
|
||||
dependencies = [
|
||||
"android_system_properties",
|
||||
"core-foundation-sys",
|
||||
"iana-time-zone-haiku",
|
||||
"js-sys",
|
||||
"log",
|
||||
"wasm-bindgen",
|
||||
"windows-core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "iana-time-zone-haiku"
|
||||
version = "0.1.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
|
||||
dependencies = [
|
||||
"cc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "icu_collections"
|
||||
version = "2.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
|
||||
dependencies = [
|
||||
"displaydoc",
|
||||
"potential_utf",
|
||||
"utf8_iter",
|
||||
"yoke",
|
||||
"zerofrom",
|
||||
"zerovec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "icu_locale_core"
|
||||
version = "2.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
|
||||
dependencies = [
|
||||
"displaydoc",
|
||||
"litemap",
|
||||
"tinystr",
|
||||
"writeable",
|
||||
"zerovec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "icu_normalizer"
|
||||
version = "2.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
|
||||
dependencies = [
|
||||
"icu_collections",
|
||||
"icu_normalizer_data",
|
||||
"icu_properties",
|
||||
"icu_provider",
|
||||
"smallvec",
|
||||
"zerovec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "icu_normalizer_data"
|
||||
version = "2.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
|
||||
|
||||
[[package]]
|
||||
name = "icu_properties"
|
||||
version = "2.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
|
||||
dependencies = [
|
||||
"icu_collections",
|
||||
"icu_locale_core",
|
||||
"icu_properties_data",
|
||||
"icu_provider",
|
||||
"zerotrie",
|
||||
"zerovec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "icu_properties_data"
|
||||
version = "2.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
|
||||
|
||||
[[package]]
|
||||
name = "icu_provider"
|
||||
version = "2.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
|
||||
dependencies = [
|
||||
"displaydoc",
|
||||
"icu_locale_core",
|
||||
"writeable",
|
||||
"yoke",
|
||||
"zerofrom",
|
||||
"zerotrie",
|
||||
"zerovec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "idna"
|
||||
version = "1.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
|
||||
dependencies = [
|
||||
"idna_adapter",
|
||||
"smallvec",
|
||||
"utf8_iter",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "idna_adapter"
|
||||
version = "1.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
|
||||
dependencies = [
|
||||
"icu_normalizer",
|
||||
"icu_properties",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "image"
|
||||
version = "0.25.10"
|
||||
@@ -882,15 +621,6 @@ version = "1.70.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
|
||||
|
||||
[[package]]
|
||||
name = "itertools"
|
||||
version = "0.13.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
|
||||
dependencies = [
|
||||
"either",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "itoa"
|
||||
version = "1.0.18"
|
||||
@@ -909,12 +639,6 @@ dependencies = [
|
||||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "lazy_static"
|
||||
version = "1.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
|
||||
|
||||
[[package]]
|
||||
name = "libc"
|
||||
version = "0.2.184"
|
||||
@@ -942,12 +666,6 @@ version = "0.12.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
|
||||
|
||||
[[package]]
|
||||
name = "litemap"
|
||||
version = "0.8.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
|
||||
|
||||
[[package]]
|
||||
name = "lock_api"
|
||||
version = "0.4.14"
|
||||
@@ -1008,12 +726,6 @@ dependencies = [
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "num-conv"
|
||||
version = "0.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
|
||||
|
||||
[[package]]
|
||||
name = "num-traits"
|
||||
version = "0.2.19"
|
||||
@@ -1207,21 +919,6 @@ dependencies = [
|
||||
"universal-hash",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "potential_utf"
|
||||
version = "0.1.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
|
||||
dependencies = [
|
||||
"zerovec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "powerfmt"
|
||||
version = "0.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
|
||||
|
||||
[[package]]
|
||||
name = "ppv-lite86"
|
||||
version = "0.2.21"
|
||||
@@ -1311,35 +1008,6 @@ dependencies = [
|
||||
"thiserror 1.0.69",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "regex"
|
||||
version = "1.12.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
|
||||
dependencies = [
|
||||
"aho-corasick",
|
||||
"memchr",
|
||||
"regex-automata",
|
||||
"regex-syntax",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "regex-automata"
|
||||
version = "0.4.14"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
|
||||
dependencies = [
|
||||
"aho-corasick",
|
||||
"memchr",
|
||||
"regex-syntax",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "regex-syntax"
|
||||
version = "0.8.10"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
|
||||
|
||||
[[package]]
|
||||
name = "relicario-cli"
|
||||
version = "0.1.0"
|
||||
@@ -1355,7 +1023,6 @@ dependencies = [
|
||||
"rpassword",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -1363,22 +1030,14 @@ name = "relicario-core"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"argon2",
|
||||
"bip39",
|
||||
"chacha20poly1305",
|
||||
"chrono",
|
||||
"ed25519-dalek",
|
||||
"getrandom",
|
||||
"hex",
|
||||
"image",
|
||||
"rand",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"sha2",
|
||||
"thiserror 2.0.18",
|
||||
"unicode-normalization",
|
||||
"url",
|
||||
"zeroize",
|
||||
"zxcvbn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -1564,12 +1223,6 @@ dependencies = [
|
||||
"der",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "stable_deref_trait"
|
||||
version = "1.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
|
||||
|
||||
[[package]]
|
||||
name = "strsim"
|
||||
version = "0.11.1"
|
||||
@@ -1593,17 +1246,6 @@ dependencies = [
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "synstructure"
|
||||
version = "0.13.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "thiserror"
|
||||
version = "1.0.69"
|
||||
@@ -1658,50 +1300,6 @@ dependencies = [
|
||||
"zune-jpeg",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "time"
|
||||
version = "0.3.47"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
|
||||
dependencies = [
|
||||
"deranged",
|
||||
"num-conv",
|
||||
"powerfmt",
|
||||
"serde_core",
|
||||
"time-core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "time-core"
|
||||
version = "0.1.8"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
|
||||
|
||||
[[package]]
|
||||
name = "tinystr"
|
||||
version = "0.8.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
|
||||
dependencies = [
|
||||
"displaydoc",
|
||||
"zerovec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tinyvec"
|
||||
version = "1.11.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
|
||||
dependencies = [
|
||||
"tinyvec_macros",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tinyvec_macros"
|
||||
version = "0.1.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
|
||||
|
||||
[[package]]
|
||||
name = "typenum"
|
||||
version = "1.19.0"
|
||||
@@ -1714,15 +1312,6 @@ version = "1.0.24"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
||||
|
||||
[[package]]
|
||||
name = "unicode-normalization"
|
||||
version = "0.1.25"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
|
||||
dependencies = [
|
||||
"tinyvec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "universal-hash"
|
||||
version = "0.5.1"
|
||||
@@ -1733,25 +1322,6 @@ dependencies = [
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "url"
|
||||
version = "2.5.8"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
|
||||
dependencies = [
|
||||
"form_urlencoded",
|
||||
"idna",
|
||||
"percent-encoding",
|
||||
"serde",
|
||||
"serde_derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "utf8_iter"
|
||||
version = "1.0.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
|
||||
|
||||
[[package]]
|
||||
name = "utf8parse"
|
||||
version = "0.2.2"
|
||||
@@ -1874,16 +1444,6 @@ version = "0.2.118"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "23cda5ecc67248c48d3e705d3e03e00af905769b78b9d2a1678b663b8b9d4472"
|
||||
|
||||
[[package]]
|
||||
name = "web-sys"
|
||||
version = "0.3.95"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4f2dfbb17949fa2088e5d39408c48368947b86f7834484e87b73de55bc14d97d"
|
||||
dependencies = [
|
||||
"js-sys",
|
||||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "weezl"
|
||||
version = "0.1.12"
|
||||
@@ -1921,65 +1481,12 @@ version = "0.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
|
||||
|
||||
[[package]]
|
||||
name = "windows-core"
|
||||
version = "0.62.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
|
||||
dependencies = [
|
||||
"windows-implement",
|
||||
"windows-interface",
|
||||
"windows-link",
|
||||
"windows-result",
|
||||
"windows-strings",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-implement"
|
||||
version = "0.60.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-interface"
|
||||
version = "0.59.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-link"
|
||||
version = "0.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
|
||||
|
||||
[[package]]
|
||||
name = "windows-result"
|
||||
version = "0.4.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
|
||||
dependencies = [
|
||||
"windows-link",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-strings"
|
||||
version = "0.5.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
|
||||
dependencies = [
|
||||
"windows-link",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-sys"
|
||||
version = "0.48.0"
|
||||
@@ -2129,12 +1636,6 @@ version = "0.53.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
|
||||
|
||||
[[package]]
|
||||
name = "writeable"
|
||||
version = "0.6.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
|
||||
|
||||
[[package]]
|
||||
name = "x11rb"
|
||||
version = "0.13.2"
|
||||
@@ -2152,29 +1653,6 @@ version = "0.13.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
|
||||
|
||||
[[package]]
|
||||
name = "yoke"
|
||||
version = "0.8.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
|
||||
dependencies = [
|
||||
"stable_deref_trait",
|
||||
"yoke-derive",
|
||||
"zerofrom",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "yoke-derive"
|
||||
version = "0.8.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
"synstructure",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zerocopy"
|
||||
version = "0.8.48"
|
||||
@@ -2195,80 +1673,11 @@ dependencies = [
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zerofrom"
|
||||
version = "0.1.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
|
||||
dependencies = [
|
||||
"zerofrom-derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zerofrom-derive"
|
||||
version = "0.1.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
"synstructure",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zeroize"
|
||||
version = "1.8.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
|
||||
dependencies = [
|
||||
"serde",
|
||||
"zeroize_derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zeroize_derive"
|
||||
version = "1.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zerotrie"
|
||||
version = "0.2.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
|
||||
dependencies = [
|
||||
"displaydoc",
|
||||
"yoke",
|
||||
"zerofrom",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zerovec"
|
||||
version = "0.11.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
|
||||
dependencies = [
|
||||
"yoke",
|
||||
"zerofrom",
|
||||
"zerovec-derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zerovec-derive"
|
||||
version = "0.11.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zmij"
|
||||
@@ -2290,19 +1699,3 @@ checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
|
||||
dependencies = [
|
||||
"zune-core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zxcvbn"
|
||||
version = "3.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ad76e35b00ad53688d6b90c431cabe3cbf51f7a4a154739e04b63004ab1c736c"
|
||||
dependencies = [
|
||||
"chrono",
|
||||
"fancy-regex",
|
||||
"itertools",
|
||||
"lazy_static",
|
||||
"regex",
|
||||
"time",
|
||||
"wasm-bindgen",
|
||||
"web-sys",
|
||||
]
|
||||
|
||||
58
README.md
58
README.md
@@ -1,4 +1,8 @@
|
||||
# idfoto
|
||||
<p align="center">
|
||||
<img src="extension/icons/relicario-logo.svg" alt="relicario" width="128" height="128">
|
||||
</p>
|
||||
|
||||
# relicario
|
||||
|
||||
A git-backed, self-hostable password manager where decryption requires two independent factors: a passphrase you memorize and a reference JPEG that carries a hidden secret. Compromise of either factor alone is insufficient.
|
||||
|
||||
@@ -19,7 +23,7 @@ Your reference photo (something you have)
|
||||
your device (opaque ciphertext)
|
||||
```
|
||||
|
||||
At vault creation, idfoto embeds a random 256-bit secret into a carrier JPEG using DCT steganography. This photo becomes your **reference image** — a second factor that lives on your devices (and optionally as a "dead drop" on social media, since it survives JPEG re-encoding and mild cropping).
|
||||
At vault creation, relicario embeds a random 256-bit secret into a carrier JPEG using DCT steganography. This photo becomes your **reference image** — a second factor that lives on your devices (and optionally as a "dead drop" on social media, since it survives JPEG re-encoding and mild cropping).
|
||||
|
||||
To unlock the vault, you provide your passphrase and point the client at the reference image. The client extracts the hidden secret, concatenates it with your passphrase, and runs Argon2id to derive the master key. Everything else follows from there.
|
||||
|
||||
@@ -30,9 +34,9 @@ To unlock the vault, you provide your passphrase and point the client at the ref
|
||||
A git repository containing:
|
||||
- `manifest.enc` — opaque binary blob
|
||||
- `entries/*.enc` — more opaque binary blobs
|
||||
- `.idfoto/salt` — a random 32-byte value (not secret)
|
||||
- `.idfoto/params.json` — Argon2id parameters (not secret)
|
||||
- `.idfoto/devices.json` — authorized device public keys
|
||||
- `.relicario/salt` — a random 32-byte value (not secret)
|
||||
- `.relicario/params.json` — Argon2id parameters (not secret)
|
||||
- `.relicario/devices.json` — authorized device public keys
|
||||
|
||||
That's it. No plaintext. No metadata about what's inside. No keys, no passphrases, no reference images.
|
||||
|
||||
@@ -54,7 +58,7 @@ No single point of failure. The two-factor design means the passphrase alone can
|
||||
| LastPass | ~40-60 bits (master password only) | 1 |
|
||||
| Bitwarden | ~40-60 bits (master password only) | 1 |
|
||||
| 1Password | password + 128-bit Secret Key | 2 |
|
||||
| **idfoto** | **password + 256-bit image secret** | **2** |
|
||||
| **relicario** | **password + 256-bit image secret** | **2** |
|
||||
|
||||
### What we don't protect against
|
||||
|
||||
@@ -69,31 +73,31 @@ No single point of failure. The two-factor design means the passphrase alone can
|
||||
cargo build --release
|
||||
|
||||
# Create a vault (pick any JPEG as the carrier)
|
||||
idfoto init --image vacation.jpg --output reference.jpg
|
||||
relicario init --image vacation.jpg --output reference.jpg
|
||||
|
||||
# Add a credential
|
||||
idfoto add
|
||||
relicario add
|
||||
|
||||
# Retrieve it
|
||||
idfoto get github
|
||||
relicario get github
|
||||
|
||||
# List everything
|
||||
idfoto list
|
||||
relicario list
|
||||
|
||||
# Sync with your git remote
|
||||
idfoto sync
|
||||
relicario sync
|
||||
|
||||
# Generate a random password
|
||||
idfoto generate -l 32
|
||||
relicario generate -l 32
|
||||
```
|
||||
|
||||
### Environment variable
|
||||
|
||||
Set `IDFOTO_IMAGE=/path/to/reference.jpg` to avoid being prompted for the image path on every command.
|
||||
Set `RELICARIO_IMAGE=/path/to/reference.jpg` to avoid being prompted for the image path on every command.
|
||||
|
||||
## The reference image
|
||||
|
||||
The reference JPEG is generated once during `idfoto init`. It looks like a normal photo — because it is one. The 256-bit secret is embedded in the DCT coefficients of the luminance channel using Quantization Index Modulation, with heavy redundancy and Reed-Solomon-style majority voting across multiple copies.
|
||||
The reference JPEG is generated once during `relicario init`. It looks like a normal photo — because it is one. The 256-bit secret is embedded in the DCT coefficients of the luminance channel using Quantization Index Modulation, with heavy redundancy and Reed-Solomon-style majority voting across multiple copies.
|
||||
|
||||
The embedding survives:
|
||||
- JPEG recompression (tested down to quality 85)
|
||||
@@ -105,20 +109,20 @@ This means your reference image can live on your Instagram, your personal websit
|
||||
## Architecture
|
||||
|
||||
```
|
||||
idfoto/
|
||||
relicario/
|
||||
├── crates/
|
||||
│ ├── idfoto-core/ # Platform-agnostic library (no filesystem, no network)
|
||||
│ ├── relicario-core/ # Platform-agnostic library (no filesystem, no network)
|
||||
│ │ ├── crypto.rs # Argon2id KDF + XChaCha20-Poly1305 AEAD
|
||||
│ │ ├── imgsecret.rs # DCT steganography: embed/extract 256-bit secrets in JPEGs
|
||||
│ │ ├── entry.rs # Entry, Manifest data model (serde)
|
||||
│ │ └── vault.rs # Encrypt/decrypt entries and manifests
|
||||
│ └── idfoto-cli/ # CLI binary: filesystem, git, terminal I/O
|
||||
│ └── relicario-cli/ # CLI binary: filesystem, git, terminal I/O
|
||||
└── docs/
|
||||
└── superpowers/
|
||||
└── specs/ # Design specification with full threat model
|
||||
```
|
||||
|
||||
`idfoto-core` takes bytes and returns bytes. It has no knowledge of filesystems, git, or networks. This makes it portable to WASM (browser extension), Android (JNI), and iOS (Swift bridge).
|
||||
`relicario-core` takes bytes and returns bytes. It has no knowledge of filesystems, git, or networks. This makes it portable to WASM (browser extension), Android (JNI), and iOS (Swift bridge).
|
||||
|
||||
### Crypto primitives
|
||||
|
||||
@@ -144,7 +148,7 @@ my-vault.git/
|
||||
├── entries/
|
||||
│ ├── a1b2c3d4.enc # One encrypted entry per file
|
||||
│ └── e5f6a7b8.enc
|
||||
└── .idfoto/
|
||||
└── .relicario/
|
||||
├── salt # 32-byte random salt (not secret)
|
||||
├── params.json # KDF parameters
|
||||
└── devices.json # Authorized device public keys
|
||||
@@ -154,14 +158,14 @@ Entry IDs are random hex strings. Git history is preserved — every add/edit/de
|
||||
|
||||
## Device management
|
||||
|
||||
Each device generates its own ed25519 keypair. The public key is stored in `.idfoto/devices.json` (committed to the repo). Device keys are used for commit signing — they do NOT participate in vault decryption.
|
||||
Each device generates its own ed25519 keypair. The public key is stored in `.relicario/devices.json` (committed to the repo). Device keys are used for commit signing — they do NOT participate in vault decryption.
|
||||
|
||||
Revoking a device: remove its key from `devices.json` and commit. No passphrase or reference image rotation needed.
|
||||
|
||||
```bash
|
||||
idfoto device add --name laptop
|
||||
idfoto device list
|
||||
idfoto device revoke laptop
|
||||
relicario device add --name laptop
|
||||
relicario device list
|
||||
relicario device revoke laptop
|
||||
```
|
||||
|
||||
## Building
|
||||
@@ -169,20 +173,20 @@ idfoto device revoke laptop
|
||||
Requires Rust stable (1.70+).
|
||||
|
||||
```bash
|
||||
git clone ssh://git@git.adlee.work:2222/alee/idfoto.git
|
||||
cd idfoto
|
||||
git clone ssh://git@git.adlee.work:2222/alee/relicario.git
|
||||
cd relicario
|
||||
cargo build --release
|
||||
cargo test
|
||||
```
|
||||
|
||||
The binary is at `target/release/idfoto`.
|
||||
The binary is at `target/release/relicario`.
|
||||
|
||||
## Roadmap
|
||||
|
||||
- [ ] WASM build + Chrome browser extension (inline crypto, no native messaging)
|
||||
- [ ] Secure notes (free-form encrypted text entries)
|
||||
- [ ] Secure document storage (encrypted file attachments up to 5-10 MB)
|
||||
- [ ] `idfoto unlock` daemon (ssh-agent-style, holds master key for a TTL)
|
||||
- [ ] `relicario unlock` daemon (ssh-agent-style, holds master key for a TTL)
|
||||
- [ ] Android/iOS clients (Rust core compiles to ARM)
|
||||
- [ ] Import from LastPass/Bitwarden/1Password
|
||||
- [ ] Firefox/Safari extensions
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
name = "relicario-cli"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
description = "CLI for idfoto password manager"
|
||||
description = "CLI for relicario password manager"
|
||||
|
||||
[[bin]]
|
||||
name = "relicario"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
//! idfoto CLI -- the platform layer for the idfoto password manager.
|
||||
//! relicario CLI -- the platform layer for the relicario password manager.
|
||||
//!
|
||||
//! This binary provides the filesystem, git, and terminal I/O that
|
||||
//! [`relicario_core`] intentionally excludes. It is the "glue" between the
|
||||
@@ -69,7 +69,7 @@ struct Cli {
|
||||
/// All available CLI subcommands.
|
||||
#[derive(Subcommand)]
|
||||
enum Commands {
|
||||
/// Initialize a new idfoto vault in the current directory.
|
||||
/// Initialize a new relicario vault in the current directory.
|
||||
/// Creates the directory structure, generates a random image secret,
|
||||
/// embeds it in the carrier image, and sets up git.
|
||||
Init {
|
||||
@@ -150,14 +150,14 @@ struct DeviceEntry {
|
||||
// ─── Helper functions ───────────────────────────────────────────────────────
|
||||
|
||||
/// Returns the vault root directory (the current working directory).
|
||||
/// The vault is always rooted at the directory where `idfoto` is invoked.
|
||||
/// The vault is always rooted at the directory where `relicario` is invoked.
|
||||
fn vault_dir() -> PathBuf {
|
||||
std::env::current_dir().expect("failed to get current directory")
|
||||
}
|
||||
|
||||
/// Returns the path to the `.relicario/` configuration directory within the vault.
|
||||
fn idfoto_dir() -> PathBuf {
|
||||
vault_dir().join(".idfoto")
|
||||
fn relicario_dir() -> PathBuf {
|
||||
vault_dir().join(".relicario")
|
||||
}
|
||||
|
||||
/// Read the 32-byte vault salt from `.relicario/salt`.
|
||||
@@ -166,7 +166,7 @@ fn idfoto_dir() -> PathBuf {
|
||||
/// not secret (stored in plaintext) -- its purpose is to prevent precomputed
|
||||
/// rainbow table attacks against the Argon2id KDF.
|
||||
fn read_salt() -> Result<[u8; 32]> {
|
||||
let data = fs::read(idfoto_dir().join("salt")).context("failed to read salt")?;
|
||||
let data = fs::read(relicario_dir().join("salt")).context("failed to read salt")?;
|
||||
let mut salt = [0u8; 32];
|
||||
if data.len() != 32 {
|
||||
bail!("invalid salt file: expected 32 bytes, got {}", data.len());
|
||||
@@ -177,7 +177,7 @@ fn read_salt() -> Result<[u8; 32]> {
|
||||
|
||||
/// Read the KDF parameters from `.relicario/params.json`.
|
||||
fn read_params() -> Result<KdfParams> {
|
||||
let data = fs::read_to_string(idfoto_dir().join("params.json"))
|
||||
let data = fs::read_to_string(relicario_dir().join("params.json"))
|
||||
.context("failed to read params.json")?;
|
||||
let params: KdfParams = serde_json::from_str(&data).context("failed to parse params.json")?;
|
||||
Ok(params)
|
||||
@@ -319,7 +319,7 @@ fn generate_password(length: usize) -> String {
|
||||
|
||||
// ─── Command implementations ────────────────────────────────────────────────
|
||||
|
||||
/// Initialize a new idfoto vault in the current directory.
|
||||
/// Initialize a new relicario vault in the current directory.
|
||||
///
|
||||
/// Full sequence:
|
||||
/// 1. Read the carrier JPEG provided by the user.
|
||||
@@ -375,18 +375,18 @@ fn cmd_init(image: PathBuf, output: PathBuf) -> Result<()> {
|
||||
.context("failed to derive master key")?;
|
||||
|
||||
// 8. Create directory structure
|
||||
let idfoto = idfoto_dir();
|
||||
fs::create_dir_all(&idfoto).context("failed to create .idfoto directory")?;
|
||||
let relicario = relicario_dir();
|
||||
fs::create_dir_all(&relicario).context("failed to create .relicario directory")?;
|
||||
fs::create_dir_all(vault_dir().join("entries")).context("failed to create entries directory")?;
|
||||
|
||||
// 9. Write config files
|
||||
fs::write(idfoto.join("salt"), &salt).context("failed to write salt")?;
|
||||
fs::write(relicario.join("salt"), &salt).context("failed to write salt")?;
|
||||
fs::write(
|
||||
idfoto.join("params.json"),
|
||||
relicario.join("params.json"),
|
||||
serde_json::to_string_pretty(¶ms)?,
|
||||
)
|
||||
.context("failed to write params.json")?;
|
||||
fs::write(idfoto.join("devices.json"), "[]").context("failed to write devices.json")?;
|
||||
fs::write(relicario.join("devices.json"), "[]").context("failed to write devices.json")?;
|
||||
|
||||
// 10. Encrypt empty manifest
|
||||
let manifest = Manifest::new();
|
||||
@@ -404,7 +404,7 @@ fn cmd_init(image: PathBuf, output: PathBuf) -> Result<()> {
|
||||
if !status.success() {
|
||||
bail!("git init failed");
|
||||
}
|
||||
git_commit("feat: initialize idfoto vault")?;
|
||||
git_commit("feat: initialize relicario vault")?;
|
||||
|
||||
// 13. Success
|
||||
eprintln!("Vault initialized successfully.");
|
||||
@@ -760,7 +760,7 @@ fn cmd_sync() -> Result<()> {
|
||||
|
||||
/// Read the device registry from `.relicario/devices.json`.
|
||||
fn read_devices() -> Result<Vec<DeviceEntry>> {
|
||||
let path = idfoto_dir().join("devices.json");
|
||||
let path = relicario_dir().join("devices.json");
|
||||
let data = fs::read_to_string(&path).context("failed to read devices.json")?;
|
||||
let devices: Vec<DeviceEntry> = serde_json::from_str(&data).context("failed to parse devices.json")?;
|
||||
Ok(devices)
|
||||
@@ -769,13 +769,13 @@ fn read_devices() -> Result<Vec<DeviceEntry>> {
|
||||
/// Write the device registry to `.relicario/devices.json`.
|
||||
fn write_devices(devices: &[DeviceEntry]) -> Result<()> {
|
||||
let data = serde_json::to_string_pretty(devices)?;
|
||||
fs::write(idfoto_dir().join("devices.json"), data).context("failed to write devices.json")?;
|
||||
fs::write(relicario_dir().join("devices.json"), data).context("failed to write devices.json")?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Register a new device by generating an ed25519 keypair.
|
||||
///
|
||||
/// The private key is saved to `~/.config/idfoto/<name>.key` with
|
||||
/// The private key is saved to `~/.config/relicario/<name>.key` with
|
||||
/// restrictive permissions (0600 on Unix). The public key is added to
|
||||
/// the vault's devices.json and committed to git.
|
||||
///
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
name = "relicario-core"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
description = "Core library for idfoto password manager"
|
||||
description = "Core library for relicario password manager"
|
||||
|
||||
[dependencies]
|
||||
thiserror = "2"
|
||||
@@ -25,3 +25,4 @@ hex = "0.4"
|
||||
url = { version = "2", features = ["serde"] }
|
||||
getrandom = "0.2"
|
||||
|
||||
[dev-dependencies]
|
||||
|
||||
@@ -298,7 +298,7 @@ mod tests {
|
||||
#[test]
|
||||
fn encrypt_decrypt_round_trip() {
|
||||
let key = [0xABu8; 32];
|
||||
let plaintext = b"hello, idfoto!";
|
||||
let plaintext = b"hello, relicario!";
|
||||
|
||||
let ciphertext = encrypt(&key, plaintext).unwrap();
|
||||
let decrypted = decrypt(&key, &ciphertext).unwrap();
|
||||
|
||||
@@ -14,9 +14,14 @@ use thiserror::Error;
|
||||
/// steganography -> serialization -> device keys.
|
||||
#[derive(Debug, Error)]
|
||||
pub enum RelicarioError {
|
||||
/// The Argon2id key derivation failed. This typically means invalid KDF
|
||||
/// parameters were supplied (e.g., memory cost below Argon2's minimum).
|
||||
#[error("key derivation failed: {0}")]
|
||||
Kdf(String),
|
||||
|
||||
/// XChaCha20-Poly1305 encryption failed. In practice this is extremely rare
|
||||
/// -- the only realistic cause is an internal library error, since the cipher
|
||||
/// accepts arbitrary-length plaintext.
|
||||
#[error("encryption failed: {0}")]
|
||||
Encrypt(String),
|
||||
|
||||
@@ -24,6 +29,10 @@ pub enum RelicarioError {
|
||||
#[error("decryption failed")]
|
||||
Decrypt,
|
||||
|
||||
/// The binary ciphertext blob does not match the expected format (e.g.,
|
||||
/// too short to contain the version byte + nonce + tag, or an unrecognized
|
||||
/// version byte). This usually indicates file corruption or a version
|
||||
/// mismatch between the writer and reader.
|
||||
#[error("invalid vault format: {0}")]
|
||||
Format(String),
|
||||
|
||||
@@ -42,9 +51,15 @@ pub enum RelicarioError {
|
||||
#[error("attachment too large: {size} bytes > {max} bytes max")]
|
||||
AttachmentTooLarge { size: u64, max: u64 },
|
||||
|
||||
/// A general error from the image steganography subsystem (imgsecret).
|
||||
/// Covers issues like failing to decode the carrier JPEG or failing to
|
||||
/// encode the output JPEG after modification.
|
||||
#[error("imgsecret: {0}")]
|
||||
ImgSecret(String),
|
||||
|
||||
/// The carrier image is too small to hold the embedded secret with
|
||||
/// sufficient redundancy. The embed region (central 70% of the image)
|
||||
/// must contain at least `BLOCKS_PER_COPY * MIN_COPIES` 8x8 blocks.
|
||||
#[error("image too small: need at least {min_width}x{min_height}, got {actual_width}x{actual_height}")]
|
||||
ImageTooSmall {
|
||||
min_width: u32,
|
||||
@@ -53,12 +68,22 @@ pub enum RelicarioError {
|
||||
actual_height: u32,
|
||||
},
|
||||
|
||||
/// Secret extraction from a JPEG failed. This can mean:
|
||||
/// - The image never had a secret embedded in it.
|
||||
/// - The image was recompressed below Q85, destroying the QIM watermarks.
|
||||
/// - The image was cropped beyond the 15% crumple zone.
|
||||
/// - Majority-vote confidence fell below the 60% threshold on one or more bits.
|
||||
#[error("extraction failed: no valid secret found in image")]
|
||||
ExtractionFailed,
|
||||
|
||||
/// JSON serialization or deserialization of an entry or manifest failed.
|
||||
/// Wraps [`serde_json::Error`] transparently via `#[from]`.
|
||||
#[error("json error: {0}")]
|
||||
Json(#[from] serde_json::Error),
|
||||
|
||||
/// An error related to device ed25519 key operations. Device keys are
|
||||
/// separate from the vault KDF -- revoking a device does not require
|
||||
/// rotating the passphrase or reference image.
|
||||
#[error("device key error: {0}")]
|
||||
DeviceKey(String),
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
//! DCT-based steganographic embedding of a 256-bit secret in JPEG images.
|
||||
//!
|
||||
//! This is the novel component of idfoto. It hides a 32-byte secret inside a
|
||||
//! This is the novel component of relicario. It hides a 32-byte secret inside a
|
||||
//! JPEG image's luminance channel using Quantization Index Modulation (QIM) on
|
||||
//! mid-frequency DCT coefficients, with majority voting across multiple redundant
|
||||
//! copies for robustness.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
//! # relicario-core
|
||||
//!
|
||||
//! Platform-agnostic core library for the idfoto password manager.
|
||||
//! Platform-agnostic core library for the relicario password manager.
|
||||
//!
|
||||
//! This crate is intentionally **bytes-in/bytes-out** -- it performs no filesystem
|
||||
//! access, no network I/O, and no git operations. All inputs arrive as byte slices
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
name = "relicario-wasm"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
description = "WASM bindings for idfoto password manager"
|
||||
description = "WASM bindings for relicario password manager"
|
||||
|
||||
[lib]
|
||||
crate-type = ["cdylib", "rlib"]
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
//! WASM bindings for the idfoto password manager.
|
||||
//! WASM bindings for the relicario password manager.
|
||||
//!
|
||||
//! This crate wraps [`relicario_core`] for use in a Chrome MV3 browser extension via
|
||||
//! `wasm-bindgen`. Every function marked `#[wasm_bindgen]` is callable from
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# idfoto — Architecture
|
||||
# relicario — Architecture
|
||||
|
||||
## System Overview
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
│ CLIENT DEVICE (trusted) │
|
||||
│ │
|
||||
│ ┌─────────────┐ ┌──────────────┐ ┌──────────────────────┐ │
|
||||
│ │ Reference │ │ Passphrase │ │ idfoto-cli │ │
|
||||
│ │ Reference │ │ Passphrase │ │ relicario-cli │ │
|
||||
│ │ JPEG │ │ (typed) │ │ or browser ext │ │
|
||||
│ │ (on disk) │ │ │ │ │ │
|
||||
│ └──────┬───────┘ └──────┬───────┘ └──────────┬───────────┘ │
|
||||
@@ -42,12 +42,12 @@
|
||||
┌──────────────────────────────────────────────────────────────────┐
|
||||
│ GIT SERVER (untrusted) │
|
||||
│ │
|
||||
│ idfoto-vault.git/ │
|
||||
│ relicario-vault.git/ │
|
||||
│ ├── manifest.enc ← opaque ciphertext │
|
||||
│ ├── entries/ │
|
||||
│ │ ├── a1b2c3d4.enc ← opaque ciphertext │
|
||||
│ │ └── e5f6a7b8.enc ← opaque ciphertext │
|
||||
│ └── .idfoto/ │
|
||||
│ └── .relicario/ │
|
||||
│ ├── salt ← 32 bytes (not secret) │
|
||||
│ ├── params.json ← KDF params (not secret) │
|
||||
│ └── devices.json ← device public keys (not secret) │
|
||||
@@ -209,15 +209,15 @@ Input JPEG (possibly re-encoded or cropped)
|
||||
|
||||
```
|
||||
┌────────────────────────────────────────────────────────────┐
|
||||
│ idfoto-cli │
|
||||
│ relicario-cli │
|
||||
│ Filesystem, git (shelling out), terminal I/O, clipboard │
|
||||
│ │
|
||||
│ Depends on: idfoto-core, clap, anyhow, rpassword, arboard │
|
||||
│ Depends on: relicario-core, clap, anyhow, rpassword, arboard │
|
||||
└──────────────────────┬─────────────────────────────────────┘
|
||||
│ uses
|
||||
▼
|
||||
┌────────────────────────────────────────────────────────────┐
|
||||
│ idfoto-core │
|
||||
│ relicario-core │
|
||||
│ Platform-agnostic: bytes in, bytes out │
|
||||
│ No filesystem, no network, no git │
|
||||
│ │
|
||||
@@ -230,7 +230,7 @@ Input JPEG (possibly re-encoded or cropped)
|
||||
│ │ │ │ QIM │ │ │ │ manifest() │ │
|
||||
│ └──────────┘ └──────────┘ └─────────┘ └────────────┘ │
|
||||
│ │
|
||||
│ Future: idfoto-wasm wraps this for browser extension │
|
||||
│ Future: relicario-wasm wraps this for browser extension │
|
||||
│ Future: JNI/Swift wrappers for Android/iOS │
|
||||
└────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
# idfoto Security Audit Report
|
||||
# relicario Security Audit Report
|
||||
|
||||
**Date:** 2026-04-18
|
||||
**Scope:** Full static review of `crates/idfoto-core/`, `crates/idfoto-cli/`, `crates/idfoto-wasm/`, `extension/src/`, both manifests, both webpack configs, and the design spec at `docs/superpowers/specs/2026-04-11-idfoto-design.md`.
|
||||
**Scope:** Full static review of `crates/relicario-core/`, `crates/relicario-cli/`, `crates/relicario-wasm/`, `extension/src/`, both manifests, both webpack configs, and the design spec at `docs/superpowers/specs/2026-04-11-relicario-design.md`.
|
||||
**Methodology:** Static review against the project's documented threat model.
|
||||
|
||||
---
|
||||
@@ -26,7 +26,7 @@ This breaks the second of the four security invariants in the design spec ("Two-
|
||||
|
||||
**Remediation:**
|
||||
|
||||
1. Remove `setup.html`, `setup.js`, `idfoto_wasm.js`, and `idfoto_wasm_bg.wasm` from `web_accessible_resources` entirely. The setup page is opened with `chrome.tabs.create({ url: chrome.runtime.getURL('setup.html') })` from the popup (`setup-wizard.ts:28`), which works fine without `web_accessible_resources` for own-origin tabs.
|
||||
1. Remove `setup.html`, `setup.js`, `relicario_wasm.js`, and `relicario_wasm_bg.wasm` from `web_accessible_resources` entirely. The setup page is opened with `chrome.tabs.create({ url: chrome.runtime.getURL('setup.html') })` from the popup (`setup-wizard.ts:28`), which works fine without `web_accessible_resources` for own-origin tabs.
|
||||
2. In the `save_setup` handler, validate the sender: require `sender.id === chrome.runtime.id` AND `sender.url?.startsWith(chrome.runtime.getURL('setup.html'))`. Reject all other senders.
|
||||
3. If a vault is already configured, require an explicit user confirmation in the popup before overwriting — don't silently swap the binding.
|
||||
4. Consider hashing the (config, imageBase64) tuple and surfacing a fingerprint to the user so a swap is at least visible.
|
||||
@@ -63,12 +63,12 @@ a) `escapeForHtml` uses the `div.textContent` round-trip trick. That escapes `&`
|
||||
|
||||
The textContent round-trip *does* escape `<`, `>`, and `&`, so injection of raw `<img>` tags is blocked. But:
|
||||
|
||||
b) The DOM the script is constructing lives in the **page's** document, not the extension's. Even if the escape were perfect, the page's existing CSS/JS sees the prompt and can read its DOM (`#idfoto-capture-prompt`, `#idfoto-save-btn`, etc.). Page JS can:
|
||||
b) The DOM the script is constructing lives in the **page's** document, not the extension's. Even if the escape were perfect, the page's existing CSS/JS sees the prompt and can read its DOM (`#relicario-capture-prompt`, `#relicario-save-btn`, etc.). Page JS can:
|
||||
- Wait for the prompt to appear via `MutationObserver`, read the `<strong>` text to learn the username being saved.
|
||||
- Programmatically `.click()` `#idfoto-save-btn` to silently save attacker-substituted credentials to the user's vault. (The `Save` handler reads `username` and `password` from variables captured at `showPrompt` call time, so it'll save *correct* values — but the page can replace the button's click listener via `cloneNode`/`replaceWith` or wrap it.)
|
||||
- Programmatically `.click()` `#idfoto-never-btn` to suppress capture for the user's *real* sites by getting them blacklisted via a confusable hostname.
|
||||
- Programmatically `.click()` `#relicario-save-btn` to silently save attacker-substituted credentials to the user's vault. (The `Save` handler reads `username` and `password` from variables captured at `showPrompt` call time, so it'll save *correct* values — but the page can replace the button's click listener via `cloneNode`/`replaceWith` or wrap it.)
|
||||
- Programmatically `.click()` `#relicario-never-btn` to suppress capture for the user's *real* sites by getting them blacklisted via a confusable hostname.
|
||||
|
||||
c) The injected button uses `id="idfoto-save-btn"`. If the page has its own element with the same id, document.getElementById on subsequent saves returns whichever the browser returns first — generally the page's. Use a Shadow DOM or unique random ids per-prompt instead.
|
||||
c) The injected button uses `id="relicario-save-btn"`. If the page has its own element with the same id, document.getElementById on subsequent saves returns whichever the browser returns first — generally the page's. Use a Shadow DOM or unique random ids per-prompt instead.
|
||||
|
||||
**Why it matters:** The capture flow is the easiest path to silent credential exfiltration. A malicious site can craft inputs and DOM such that submitting *any* form on the page causes the user's vault to capture and save attacker-chosen credentials labeled as the user's bank/email, or such that legitimate save prompts get `Never`-clicked and silently blacklisted.
|
||||
|
||||
@@ -77,7 +77,7 @@ c) The injected button uses `id="idfoto-save-btn"`. If the page has its own elem
|
||||
1. Render the prompt inside a closed Shadow DOM: `const root = container.attachShadow({ mode: 'closed' });` then `root.innerHTML = ...`. Closed shadow DOM is invisible to the page's JS.
|
||||
2. Replace `escapeForHtml(displayUser)` with `textContent` assignments rather than `innerHTML`. Construct the DOM with `document.createElement` + `.textContent =` for any attacker-derived strings.
|
||||
3. Treat all values from `findUsernameValue` as fully untrusted; sanity-check they're not control characters or exceptionally long.
|
||||
4. Do not use stable IDs (`idfoto-save-btn`) on elements injected into a hostile DOM.
|
||||
4. Do not use stable IDs (`relicario-save-btn`) on elements injected into a hostile DOM.
|
||||
|
||||
---
|
||||
|
||||
@@ -93,7 +93,7 @@ c) The injected button uses `id="idfoto-save-btn"`. If the page has its own elem
|
||||
|
||||
The icon-click flow is presented as the "intended" path, but nothing in the code enforces that the icon must be the trigger. The design spec section "Autofill anti-phishing (origin checks)" is referenced in the audit prompt but is not implemented anywhere.
|
||||
|
||||
**Why it matters:** This is the classic phishing primitive a password manager exists to prevent. idfoto currently has weaker origin discipline than even a manually-typed-in form would have.
|
||||
**Why it matters:** This is the classic phishing primitive a password manager exists to prevent. relicario currently has weaker origin discipline than even a manually-typed-in form would have.
|
||||
|
||||
**Remediation:**
|
||||
|
||||
@@ -108,7 +108,7 @@ The icon-click flow is presented as the "intended" path, but nothing in the code
|
||||
|
||||
### H1. Argon2id password input is the unprefixed concatenation of passphrase || image_secret — collision-engineerable second-preimage path
|
||||
|
||||
**File:** `crates/idfoto-core/src/crypto.rs:225-227`.
|
||||
**File:** `crates/relicario-core/src/crypto.rs:225-227`.
|
||||
|
||||
**Issue:** `password = passphrase || image_secret`. Two distinct (passphrase, image_secret) pairs produce the same Argon2id input — e.g. `("abc", [0x44, 0x55, …])` and `("abcD", [0x55, …])` differ only in where the boundary sits but produce identical concatenations and therefore identical master keys. The design spec explicitly calls this out as "the canonical Argon2id API — no custom construction" but it's not canonical at all; concatenating two variable-length values without a length prefix is a textbook construction smell.
|
||||
|
||||
@@ -131,9 +131,9 @@ Cite spec line: the spec at "Key derivation" explicitly says "concatenated, 32-b
|
||||
|
||||
### H2. Master key never zeroized; `Vec<u8>` from `derive_master_key` and intermediate buffers leak into reallocated heap
|
||||
|
||||
**File:** `crates/idfoto-core/src/crypto.rs:205-235`, `crates/idfoto-cli/src/main.rs:204-218` and every command that calls `unlock`.
|
||||
**File:** `crates/relicario-core/src/crypto.rs:205-235`, `crates/relicario-cli/src/main.rs:204-218` and every command that calls `unlock`.
|
||||
|
||||
**Issue:** The Argon2id output (`output: [u8; 32]`) is returned by value, copied into an owned `Vec` in `idfoto-wasm`'s `derive_master_key` (`lib.rs:62`), then handed to JS as a `Uint8Array` whose backing memory lives in the WASM linear memory. Nothing implements `Drop` to wipe the bytes. The intermediate `password` Vec at `crypto.rs:225-227` (which contains the *passphrase plaintext* alongside the image_secret) is also dropped without zeroizing — its buffer is freed and may be reallocated for unrelated purposes, retaining the passphrase in process memory until overwritten.
|
||||
**Issue:** The Argon2id output (`output: [u8; 32]`) is returned by value, copied into an owned `Vec` in `relicario-wasm`'s `derive_master_key` (`lib.rs:62`), then handed to JS as a `Uint8Array` whose backing memory lives in the WASM linear memory. Nothing implements `Drop` to wipe the bytes. The intermediate `password` Vec at `crypto.rs:225-227` (which contains the *passphrase plaintext* alongside the image_secret) is also dropped without zeroizing — its buffer is freed and may be reallocated for unrelated purposes, retaining the passphrase in process memory until overwritten.
|
||||
|
||||
In the CLI, the passphrase string from `rpassword::prompt_password_stderr` (an owned `String`) is also not zeroized. The `master_key: [u8; 32]` returned from `unlock` is just a stack array — better — but it gets passed by reference to `encrypt_entry` etc. which call into XChaCha20Poly1305 internals that may copy the key.
|
||||
|
||||
@@ -141,7 +141,7 @@ In the CLI, the passphrase string from `rpassword::prompt_password_stderr` (an o
|
||||
|
||||
**Remediation:**
|
||||
|
||||
1. Add `zeroize = "1"` and `zeroize_derive` to `idfoto-core`.
|
||||
1. Add `zeroize = "1"` and `zeroize_derive` to `relicario-core`.
|
||||
2. Wrap `master_key` in `Zeroizing<[u8; 32]>` in both `derive_master_key` return and at all CLI/WASM call sites.
|
||||
3. Wrap the temporary `password` Vec in `Zeroizing<Vec<u8>>` so its contents are wiped on drop.
|
||||
4. In the CLI, zeroize the passphrase string immediately after passing into `derive_master_key`.
|
||||
@@ -152,7 +152,7 @@ In the CLI, the passphrase string from `rpassword::prompt_password_stderr` (an o
|
||||
|
||||
### H3. Passphrase strength gate is purely cosmetic; the only enforced minimum is 8 characters
|
||||
|
||||
**File:** `crates/idfoto-cli/src/main.rs:354-356`, `extension/src/setup/setup.ts:74-85, 363-373`.
|
||||
**File:** `crates/relicario-cli/src/main.rs:354-356`, `extension/src/setup/setup.ts:74-85, 363-373`.
|
||||
|
||||
**Issue:** The CLI requires `>= 8` characters — no entropy enforcement. The extension calls `passphraseStrength()` purely for the colored bar; the create-vault step accepts any non-empty passphrase including a single character (`if (!state.passphrase) bail`). This contradicts the spec's "Adversaries → Stolen device + weak passphrase: enforce minimum passphrase strength at vault creation" defense.
|
||||
|
||||
@@ -170,7 +170,7 @@ The threat model says the passphrase carries the entire entropy load against an
|
||||
|
||||
### H4. CLI git_commit shells out without disabling pager / signed commits / hooks; no git config isolation
|
||||
|
||||
**File:** `crates/idfoto-cli/src/main.rs:239-257, 402-405, 736-756`.
|
||||
**File:** `crates/relicario-cli/src/main.rs:239-257, 402-405, 736-756`.
|
||||
|
||||
**Issue:** Every CLI mutation runs `git add -A` then `git commit -m <message>`. There are no environmental guards:
|
||||
|
||||
@@ -189,13 +189,13 @@ Command::new("git")
|
||||
"-c", "core.editor=true", "commit", "-m", message])
|
||||
```
|
||||
|
||||
Stage only the specific files the operation touched (`entries/<id>.enc`, `manifest.enc`, `.idfoto/devices.json`) instead of `git add -A`.
|
||||
Stage only the specific files the operation touched (`entries/<id>.enc`, `manifest.enc`, `.relicario/devices.json`) instead of `git add -A`.
|
||||
|
||||
---
|
||||
|
||||
### H5. WASM `generate_password` uses `Math.random()` — claimed "non-security-critical" is wrong
|
||||
|
||||
**File:** `crates/idfoto-wasm/src/lib.rs:240-256`.
|
||||
**File:** `crates/relicario-wasm/src/lib.rs:240-256`.
|
||||
|
||||
**Issue:** The doc comment says "Uses `js_sys::Math::random()` for randomness (not cryptographically secure, but sufficient for password character selection)." This is **flatly wrong**. Generated passwords are the user's stored credential for whatever site they're saving — they must be CSPRNG-derived. `Math.random()` is V8's xorshift128+ which is:
|
||||
|
||||
@@ -205,7 +205,7 @@ Stage only the specific files the operation touched (`entries/<id>.enc`, `manife
|
||||
|
||||
The ext-bundled `crypto.getRandomValues` is available in service-worker context (it's used at `setup.ts:384`). There is no reason to use `Math.random` here.
|
||||
|
||||
**Remediation:** Replace both `generate_password` and `generate_entry_id` in `idfoto-wasm` to use `getrandom` (already in the dependency list with `features = ["js"]` enabled, line in `Cargo.toml`). Equivalent to:
|
||||
**Remediation:** Replace both `generate_password` and `generate_entry_id` in `relicario-wasm` to use `getrandom` (already in the dependency list with `features = ["js"]` enabled, line in `Cargo.toml`). Equivalent to:
|
||||
|
||||
```rust
|
||||
use rand::{rngs::OsRng, RngCore};
|
||||
@@ -221,7 +221,7 @@ Also: the modulo-by-charset-length introduces small bias (`CHARSET.len() = 87`,
|
||||
|
||||
### H6. CLI password generator has modulo bias
|
||||
|
||||
**File:** `crates/idfoto-cli/src/main.rs:308-317`.
|
||||
**File:** `crates/relicario-cli/src/main.rs:308-317`.
|
||||
|
||||
**Issue:** `(rng.next_u32() as usize) % CHARSET.len()` where `CHARSET.len() == 75`. Since `2^32 % 75 = 1` (≈), bias is mild, but still nonzero. For a tool whose entire job is generating high-entropy secrets, use `rand::distributions::Uniform` or rejection sampling.
|
||||
|
||||
@@ -236,7 +236,7 @@ let dist = Uniform::from(0..CHARSET.len());
|
||||
|
||||
### H7. `rpassword 5.0.1` is from 2020 and the API used (`prompt_password_stderr`) was deprecated and removed in 6.x
|
||||
|
||||
**File:** `crates/idfoto-cli/Cargo.toml` (`rpassword = "5"`), `main.rs:205, 352, 358`.
|
||||
**File:** `crates/relicario-cli/Cargo.toml` (`rpassword = "5"`), `main.rs:205, 352, 358`.
|
||||
|
||||
**Issue:** `rpassword 5.0.1` predates several documented platform handling fixes (Windows console, terminal-restoration on signal). The current crate is at 7.x. `prompt_password_stderr` was removed; use `prompt_password` and pipe it to stderr separately, or call `rpassword::prompt_password_from_bufread` for testability. Stale dep is a supply-chain hygiene issue and may carry unfixed terminal-restoration bugs that leave the TTY in no-echo mode if the user Ctrl-C's mid-prompt.
|
||||
|
||||
@@ -266,19 +266,19 @@ The spec says this is "acceptable" and that the reference image is supposed to l
|
||||
|
||||
### M1. `read_block` panics on out-of-bounds via `read_block_abs(...).unwrap()`
|
||||
|
||||
`crates/idfoto-core/src/imgsecret.rs:252-256`. Future block-selection changes could panic at runtime; in WASM this aborts the whole service worker. Return `Result` and propagate, or `debug_assert!`.
|
||||
`crates/relicario-core/src/imgsecret.rs:252-256`. Future block-selection changes could panic at runtime; in WASM this aborts the whole service worker. Return `Result` and propagate, or `debug_assert!`.
|
||||
|
||||
### M2. `bits_to_bytes` length not validated in `try_extract_with_layout`
|
||||
|
||||
`crates/idfoto-core/src/imgsecret.rs:765-768`. `secret.copy_from_slice(&result_bytes[..32])` panics if `result_bytes.len() < 32`. Add `debug_assert_eq!` and prefer `try_into()`.
|
||||
`crates/relicario-core/src/imgsecret.rs:765-768`. `secret.copy_from_slice(&result_bytes[..32])` panics if `result_bytes.len() < 32`. Add `debug_assert_eq!` and prefer `try_into()`.
|
||||
|
||||
### M3. `extract_with_crop_recovery` has unbounded compute for attacker-controlled JPEG dimensions
|
||||
|
||||
`crates/idfoto-core/src/imgsecret.rs:784-833`. A 32000×32000 attacker-supplied JPEG can wedge the service worker for tens of seconds. Cap `MAX_DIMENSION` (e.g. 10000 px) and peek dimensions before full decode.
|
||||
`crates/relicario-core/src/imgsecret.rs:784-833`. A 32000×32000 attacker-supplied JPEG can wedge the service worker for tens of seconds. Cap `MAX_DIMENSION` (e.g. 10000 px) and peek dimensions before full decode.
|
||||
|
||||
### M4. `decrypt` error path leaks coarse timing about which validation failed first
|
||||
|
||||
`crates/idfoto-core/src/crypto.rs:115-141`. Not exploitable today (only attacker-supplied ciphertexts are the user's own files). If a "share an entry" feature lands, this becomes a side channel. Consider returning `IdfotoError::Decrypt` for all failure modes.
|
||||
`crates/relicario-core/src/crypto.rs:115-141`. Not exploitable today (only attacker-supplied ciphertexts are the user's own files). If a "share an entry" feature lands, this becomes a side channel. Consider returning `RelicarioError::Decrypt` for all failure modes.
|
||||
|
||||
### M5. `chrome.tabs.sendMessage` in fill_credentials sends to currently-active tab without verifying the tab matches the entry's origin
|
||||
|
||||
@@ -286,19 +286,19 @@ The spec says this is "acceptable" and that the reference image is supposed to l
|
||||
|
||||
### M6. CLI clipboard clear is best-effort and racy
|
||||
|
||||
`crates/idfoto-cli/src/main.rs:565-585`. The 30s clear thread holds a *clone* of the plaintext password for 30 seconds and won't clear if user copies anything else and back. Always clear unconditionally; wrap in `Zeroizing<String>`.
|
||||
`crates/relicario-cli/src/main.rs:565-585`. The 30s clear thread holds a *clone* of the plaintext password for 30 seconds and won't clear if user copies anything else and back. Always clear unconditionally; wrap in `Zeroizing<String>`.
|
||||
|
||||
### M7. CLI prints the full password to stdout via `println!`
|
||||
|
||||
`crates/idfoto-cli/src/main.rs:553`. `idfoto get` prints `"Password: <plaintext>"` to stdout — ends up in scrollback, `script` transcripts, tmux capture, pipes. Show `********` by default; require `--show` flag.
|
||||
`crates/relicario-cli/src/main.rs:553`. `relicario get` prints `"Password: <plaintext>"` to stdout — ends up in scrollback, `script` transcripts, tmux capture, pipes. Show `********` by default; require `--show` flag.
|
||||
|
||||
### M8. CLI generates entry IDs with only 32 bits of randomness; 8-char hex collisions are realistic
|
||||
|
||||
`crates/idfoto-core/src/entry.rs:159-163`. Birthday-bound: ~65k entries gives ~50% collision; `manifest.add_entry` silently overwrites. Bump to 16-char hex (64 bits), or check before write.
|
||||
`crates/relicario-core/src/entry.rs:159-163`. Birthday-bound: ~65k entries gives ~50% collision; `manifest.add_entry` silently overwrites. Bump to 16-char hex (64 bits), or check before write.
|
||||
|
||||
### M9. WASM TOTP code has no guard against `result[offset + 3]` index when HMAC output is exactly 20 bytes
|
||||
|
||||
`crates/idfoto-wasm/src/lib.rs:227-232`. Safe today (HMAC-SHA1 is always 20 bytes, max offset is 15). Add `debug_assert_eq!(result.len(), 20)` for future-proofing.
|
||||
`crates/relicario-wasm/src/lib.rs:227-232`. Safe today (HMAC-SHA1 is always 20 bytes, max offset is 15). Add `debug_assert_eq!(result.len(), 20)` for future-proofing.
|
||||
|
||||
### M10. `setup-wizard.ts` opens a new tab, but `window.close()` is no-op if popup is not in popup context
|
||||
|
||||
@@ -306,24 +306,24 @@ The spec says this is "acceptable" and that the reference image is supposed to l
|
||||
|
||||
### M11. CLI `now_iso8601` returns Unix seconds but the field is named `iso8601` and the spec promises ISO 8601 formatting
|
||||
|
||||
`crates/idfoto-cli/src/main.rs:263-268`. Function name lies; consumers may parse timestamps and silently mishandle a numeric value. Either rename or use chrono/jiff.
|
||||
`crates/relicario-cli/src/main.rs:263-268`. Function name lies; consumers may parse timestamps and silently mishandle a numeric value. Either rename or use chrono/jiff.
|
||||
|
||||
### M12. `arboard 3` carries platform-dependent behavior; password may persist after `set_text("")` on Linux X11
|
||||
|
||||
`crates/idfoto-cli/src/main.rs:572-579`. Document Linux limitations.
|
||||
`crates/relicario-cli/src/main.rs:572-579`. Document Linux limitations.
|
||||
|
||||
---
|
||||
|
||||
## LOW / INFORMATIONAL
|
||||
|
||||
- **L1.** Dead-code-allowed fields in `EmbedRegion` (`crates/idfoto-core/src/imgsecret.rs:163, 166`).
|
||||
- **L2.** `IdfotoError::Format` exposes the offending version byte in user-facing error string. Minor info disclosure.
|
||||
- **L1.** Dead-code-allowed fields in `EmbedRegion` (`crates/relicario-core/src/imgsecret.rs:163, 166`).
|
||||
- **L2.** `RelicarioError::Format` exposes the offending version byte in user-facing error string. Minor info disclosure.
|
||||
- **L3.** Capture flow's `check_credential` decrypts every candidate entry on every form submit (`index.ts:421-423`). Cache password hash, not password.
|
||||
- **L4.** `popup.ts:16-20` `setState` triggers full re-render every state change — in-flight async responses can race and double-fire.
|
||||
- **L5.** Chrome MV3 manifest CSP includes `'wasm-unsafe-eval'` — required but document why.
|
||||
- **L6.** `git-host.ts:27` uses `String.fromCharCode(bytes[i])` for base64 — vulnerable to memory pressure with large reference images. Use chunked or `FileReader`.
|
||||
- **L7.** `Cargo.toml` allows wide major-version ranges. No `cargo audit` / `cargo deny` config in repo.
|
||||
- **L8.** CLI `vault_dir()` silently returns `current_dir()` — `idfoto add` in `/home` will start writing files there. Detect missing `.idfoto/` and bail.
|
||||
- **L8.** CLI `vault_dir()` silently returns `current_dir()` — `relicario add` in `/home` will start writing files there. Detect missing `.relicario/` and bail.
|
||||
- **L9.** `devices.json` initial write differs between CLI (`"[]"`) and extension (`'{"devices":[]}'`). Schema mismatch.
|
||||
- **L10.** `totpSecretCache` (`Map<string, string>` of plaintext base32 secrets) has no zeroization — note that JS strings can't be zeroized.
|
||||
- **L11.** `escapeHtml` at `popup.ts:16-20` doesn't escape `'` (single quote). Codebase uses double quotes for attributes, so currently safe but fragile.
|
||||
@@ -341,7 +341,7 @@ These primitives and parameters are correctly used and do **not** need further w
|
||||
4. **`crypto.getRandomValues`** in setup wizard for image_secret + salt (`setup.ts:383-393`).
|
||||
5. **ed25519-dalek 2.2.0** with `rand_core` — modern strict-verification version.
|
||||
6. **TOTP / RFC 6238** in WASM is correct; unit tests exercise published RFC test vectors (`wasm/lib.rs:280-301`).
|
||||
7. **AEAD failure → opaque `IdfotoError::Decrypt`** with generic message ("wrong key or corrupted data"). Avoids leaking which factor is wrong (`error.rs:33`, `crypto.rs:138`).
|
||||
7. **AEAD failure → opaque `RelicarioError::Decrypt`** with generic message ("wrong key or corrupted data"). Avoids leaking which factor is wrong (`error.rs:33`, `crypto.rs:138`).
|
||||
8. **Version byte (0x01)** at start of every ciphertext blob with rejection of unknown versions.
|
||||
9. **Two-factor independence** verified by `tests/integration.rs:120-153`.
|
||||
10. **DCT round-trip correctness** verified to 1e-6 tolerance.
|
||||
@@ -367,6 +367,6 @@ These primitives and parameters are correctly used and do **not** need further w
|
||||
|
||||
## Summary
|
||||
|
||||
idfoto's *core cryptography* is solid: correct AEAD, correct KDF parameters, real two-factor key derivation. The bugs are concentrated in the *extension boundary* and the *plumbing around the crypto*: the setup wizard is web-accessible without sender checks (C1), the message router trusts every caller (C2), capture and autofill have no origin discipline (C3, C4), the WASM password generator is non-cryptographic (H5), and master-key/passphrase memory hygiene is absent (H2).
|
||||
relicario's *core cryptography* is solid: correct AEAD, correct KDF parameters, real two-factor key derivation. The bugs are concentrated in the *extension boundary* and the *plumbing around the crypto*: the setup wizard is web-accessible without sender checks (C1), the message router trusts every caller (C2), capture and autofill have no origin discipline (C3, C4), the WASM password generator is non-cryptographic (H5), and master-key/passphrase memory hygiene is absent (H2).
|
||||
|
||||
**C1–C4 together are exploitable end-to-end and should be treated as release blockers.** H1–H8 should land before any tagged 1.0; M-class items can be batched into hardening PRs.
|
||||
|
||||
@@ -1,46 +1,46 @@
|
||||
# idfoto Core + CLI Implementation Plan
|
||||
# relicario Core + CLI Implementation Plan
|
||||
|
||||
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
|
||||
|
||||
**Goal:** Build a working git-backed password manager with a Rust core library and CLI that can create vaults, add/get/list/edit/rm credentials, sync via git, and manage device keys — all backed by the reference-image + passphrase two-factor KDF.
|
||||
|
||||
**Architecture:** Cargo workspace with two crates: `idfoto-core` (platform-agnostic library — KDF, AEAD, vault format, imgsecret DCT embedding) and `idfoto-cli` (filesystem, git, terminal I/O). The core takes bytes and returns bytes; the CLI handles all platform interaction. TDD throughout.
|
||||
**Architecture:** Cargo workspace with two crates: `relicario-core` (platform-agnostic library — KDF, AEAD, vault format, imgsecret DCT embedding) and `relicario-cli` (filesystem, git, terminal I/O). The core takes bytes and returns bytes; the CLI handles all platform interaction. TDD throughout.
|
||||
|
||||
**Tech Stack:** Rust (stable, 2021 edition), argon2, chacha20poly1305, image, serde/serde_json, clap, ed25519-dalek
|
||||
|
||||
**Scope:** This is Plan 1 of 2. This plan covers `idfoto-core` and `idfoto-cli`. Plan 2 (idfoto-wasm + Chrome extension) follows after this is working. This plan produces a complete, usable CLI password manager.
|
||||
**Scope:** This is Plan 1 of 2. This plan covers `relicario-core` and `relicario-cli`. Plan 2 (relicario-wasm + Chrome extension) follows after this is working. This plan produces a complete, usable CLI password manager.
|
||||
|
||||
**Prerequisites:** Rust stable installed via `rustup`. Git installed. A test JPEG image (any cell phone photo) available for manual testing.
|
||||
|
||||
**Design spec:** `docs/superpowers/specs/2026-04-11-idfoto-design.md`
|
||||
**Design spec:** `docs/superpowers/specs/2026-04-11-relicario-design.md`
|
||||
|
||||
---
|
||||
|
||||
## File Structure
|
||||
|
||||
```
|
||||
idfoto/ (project root = /home/alee/Sources/axsbadge.me)
|
||||
relicario/ (project root = /home/alee/Sources/relicario)
|
||||
├── Cargo.toml # workspace root
|
||||
├── crates/
|
||||
│ ├── idfoto-core/
|
||||
│ ├── relicario-core/
|
||||
│ │ ├── Cargo.toml
|
||||
│ │ └── src/
|
||||
│ │ ├── lib.rs # re-exports public API
|
||||
│ │ ├── error.rs # IdfotoError enum (thiserror)
|
||||
│ │ ├── error.rs # RelicarioError enum (thiserror)
|
||||
│ │ ├── crypto.rs # derive_master_key(), encrypt(), decrypt()
|
||||
│ │ ├── entry.rs # Entry, ManifestEntry, Manifest structs
|
||||
│ │ ├── vault.rs # encrypt/decrypt entries + manifest, binary format
|
||||
│ │ └── imgsecret.rs # embed(), extract() — DCT embedding primitive
|
||||
│ └── idfoto-cli/
|
||||
│ └── relicario-cli/
|
||||
│ ├── Cargo.toml
|
||||
│ └── src/
|
||||
│ └── main.rs # clap CLI with all subcommands
|
||||
├── docs/
|
||||
│ └── superpowers/
|
||||
│ ├── specs/
|
||||
│ │ └── 2026-04-11-idfoto-design.md
|
||||
│ │ └── 2026-04-11-relicario-design.md
|
||||
│ └── plans/
|
||||
│ └── 2026-04-11-idfoto-core-cli.md (this file)
|
||||
│ └── 2026-04-11-relicario-core-cli.md (this file)
|
||||
└── README.md
|
||||
```
|
||||
|
||||
@@ -50,10 +50,10 @@ idfoto/ (project root = /home/alee/Sources/axsbadge
|
||||
|
||||
**Files:**
|
||||
- Create: `Cargo.toml`
|
||||
- Create: `crates/idfoto-core/Cargo.toml`
|
||||
- Create: `crates/idfoto-core/src/lib.rs`
|
||||
- Create: `crates/idfoto-cli/Cargo.toml`
|
||||
- Create: `crates/idfoto-cli/src/main.rs`
|
||||
- Create: `crates/relicario-core/Cargo.toml`
|
||||
- Create: `crates/relicario-core/src/lib.rs`
|
||||
- Create: `crates/relicario-cli/Cargo.toml`
|
||||
- Create: `crates/relicario-cli/src/main.rs`
|
||||
|
||||
- [ ] **Step 1: Create workspace root Cargo.toml**
|
||||
|
||||
@@ -62,20 +62,20 @@ idfoto/ (project root = /home/alee/Sources/axsbadge
|
||||
[workspace]
|
||||
resolver = "2"
|
||||
members = [
|
||||
"crates/idfoto-core",
|
||||
"crates/idfoto-cli",
|
||||
"crates/relicario-core",
|
||||
"crates/relicario-cli",
|
||||
]
|
||||
```
|
||||
|
||||
- [ ] **Step 2: Create idfoto-core crate**
|
||||
- [ ] **Step 2: Create relicario-core crate**
|
||||
|
||||
```toml
|
||||
# crates/idfoto-core/Cargo.toml
|
||||
# crates/relicario-core/Cargo.toml
|
||||
[package]
|
||||
name = "idfoto-core"
|
||||
name = "relicario-core"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
description = "Core library for idfoto password manager"
|
||||
description = "Core library for relicario password manager"
|
||||
|
||||
[dependencies]
|
||||
thiserror = "2"
|
||||
@@ -92,26 +92,26 @@ image = { version = "0.25", default-features = false, features = ["jpeg"] }
|
||||
```
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/lib.rs
|
||||
// crates/relicario-core/src/lib.rs
|
||||
pub mod error;
|
||||
```
|
||||
|
||||
- [ ] **Step 3: Create idfoto-cli crate**
|
||||
- [ ] **Step 3: Create relicario-cli crate**
|
||||
|
||||
```toml
|
||||
# crates/idfoto-cli/Cargo.toml
|
||||
# crates/relicario-cli/Cargo.toml
|
||||
[package]
|
||||
name = "idfoto-cli"
|
||||
name = "relicario-cli"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
description = "CLI for idfoto password manager"
|
||||
description = "CLI for relicario password manager"
|
||||
|
||||
[[bin]]
|
||||
name = "idfoto"
|
||||
name = "relicario"
|
||||
path = "src/main.rs"
|
||||
|
||||
[dependencies]
|
||||
idfoto-core = { path = "../idfoto-core" }
|
||||
relicario-core = { path = "../relicario-core" }
|
||||
clap = { version = "4", features = ["derive"] }
|
||||
anyhow = "1"
|
||||
rpassword = "5"
|
||||
@@ -120,9 +120,9 @@ dirs = "5"
|
||||
```
|
||||
|
||||
```rust
|
||||
// crates/idfoto-cli/src/main.rs
|
||||
// crates/relicario-cli/src/main.rs
|
||||
fn main() {
|
||||
println!("idfoto v0.1.0");
|
||||
println!("relicario v0.1.0");
|
||||
}
|
||||
```
|
||||
|
||||
@@ -138,7 +138,7 @@ git init
|
||||
echo "target/" > .gitignore
|
||||
echo ".superpowers/" >> .gitignore
|
||||
git add Cargo.toml crates/ .gitignore docs/
|
||||
git commit -m "feat: scaffold Cargo workspace with idfoto-core and idfoto-cli"
|
||||
git commit -m "feat: scaffold Cargo workspace with relicario-core and relicario-cli"
|
||||
```
|
||||
|
||||
---
|
||||
@@ -146,17 +146,17 @@ git commit -m "feat: scaffold Cargo workspace with idfoto-core and idfoto-cli"
|
||||
### Task 2: Error Types
|
||||
|
||||
**Files:**
|
||||
- Create: `crates/idfoto-core/src/error.rs`
|
||||
- Modify: `crates/idfoto-core/src/lib.rs`
|
||||
- Create: `crates/relicario-core/src/error.rs`
|
||||
- Modify: `crates/relicario-core/src/lib.rs`
|
||||
|
||||
- [ ] **Step 1: Write the error enum**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/error.rs
|
||||
// crates/relicario-core/src/error.rs
|
||||
use thiserror::Error;
|
||||
|
||||
#[derive(Debug, Error)]
|
||||
pub enum IdfotoError {
|
||||
pub enum RelicarioError {
|
||||
#[error("key derivation failed: {0}")]
|
||||
Kdf(String),
|
||||
|
||||
@@ -193,16 +193,16 @@ pub enum IdfotoError {
|
||||
DeviceKey(String),
|
||||
}
|
||||
|
||||
pub type Result<T> = std::result::Result<T, IdfotoError>;
|
||||
pub type Result<T> = std::result::Result<T, RelicarioError>;
|
||||
```
|
||||
|
||||
- [ ] **Step 2: Update lib.rs to re-export**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/lib.rs
|
||||
// crates/relicario-core/src/lib.rs
|
||||
pub mod error;
|
||||
|
||||
pub use error::{IdfotoError, Result};
|
||||
pub use error::{RelicarioError, Result};
|
||||
```
|
||||
|
||||
- [ ] **Step 3: Verify build**
|
||||
@@ -213,8 +213,8 @@ Expected: Compiles cleanly.
|
||||
- [ ] **Step 4: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/error.rs crates/idfoto-core/src/lib.rs
|
||||
git commit -m "feat: add IdfotoError enum with thiserror"
|
||||
git add crates/relicario-core/src/error.rs crates/relicario-core/src/lib.rs
|
||||
git commit -m "feat: add RelicarioError enum with thiserror"
|
||||
```
|
||||
|
||||
---
|
||||
@@ -222,13 +222,13 @@ git commit -m "feat: add IdfotoError enum with thiserror"
|
||||
### Task 3: Crypto — Key Derivation
|
||||
|
||||
**Files:**
|
||||
- Create: `crates/idfoto-core/src/crypto.rs`
|
||||
- Modify: `crates/idfoto-core/src/lib.rs`
|
||||
- Create: `crates/relicario-core/src/crypto.rs`
|
||||
- Modify: `crates/relicario-core/src/lib.rs`
|
||||
|
||||
- [ ] **Step 1: Write the failing test**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/crypto.rs
|
||||
// crates/relicario-core/src/crypto.rs
|
||||
|
||||
// ... (implementation comes in step 3)
|
||||
|
||||
@@ -274,17 +274,17 @@ mod tests {
|
||||
|
||||
- [ ] **Step 2: Run test to verify it fails**
|
||||
|
||||
Run: `cargo test -p idfoto-core derive_master_key`
|
||||
Run: `cargo test -p relicario-core derive_master_key`
|
||||
Expected: FAIL — `derive_master_key` and `KdfParams` not defined.
|
||||
|
||||
- [ ] **Step 3: Write the implementation**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/crypto.rs
|
||||
// crates/relicario-core/src/crypto.rs
|
||||
use argon2::{Algorithm, Argon2, Params, Version};
|
||||
use crate::error::{IdfotoError, Result};
|
||||
use crate::error::{RelicarioError, Result};
|
||||
|
||||
/// Argon2id tuning parameters. Stored in .idfoto/params.json.
|
||||
/// Argon2id tuning parameters. Stored in .relicario/params.json.
|
||||
#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
|
||||
pub struct KdfParams {
|
||||
/// Memory cost in KiB (default: 65536 = 64 MiB)
|
||||
@@ -308,7 +308,7 @@ impl Default for KdfParams {
|
||||
/// Derive a 32-byte master key from passphrase + image_secret + salt.
|
||||
///
|
||||
/// password = passphrase_bytes || image_secret_bytes (concatenated)
|
||||
/// salt = vault_salt (32 bytes from .idfoto/salt)
|
||||
/// salt = vault_salt (32 bytes from .relicario/salt)
|
||||
pub fn derive_master_key(
|
||||
passphrase: &[u8],
|
||||
image_secret: &[u8; 32],
|
||||
@@ -326,14 +326,14 @@ pub fn derive_master_key(
|
||||
params.argon2_p,
|
||||
Some(32),
|
||||
)
|
||||
.map_err(|e| IdfotoError::Kdf(e.to_string()))?;
|
||||
.map_err(|e| RelicarioError::Kdf(e.to_string()))?;
|
||||
|
||||
let argon2 = Argon2::new(Algorithm::Argon2id, Version::V0x13, argon2_params);
|
||||
|
||||
let mut output = [0u8; 32];
|
||||
argon2
|
||||
.hash_password_into(&password, salt, &mut output)
|
||||
.map_err(|e| IdfotoError::Kdf(e.to_string()))?;
|
||||
.map_err(|e| RelicarioError::Kdf(e.to_string()))?;
|
||||
|
||||
Ok(output)
|
||||
}
|
||||
@@ -389,24 +389,24 @@ mod tests {
|
||||
|
||||
- [ ] **Step 4: Run tests**
|
||||
|
||||
Run: `cargo test -p idfoto-core derive_master_key`
|
||||
Run: `cargo test -p relicario-core derive_master_key`
|
||||
Expected: All 3 tests PASS.
|
||||
|
||||
- [ ] **Step 5: Update lib.rs**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/lib.rs
|
||||
// crates/relicario-core/src/lib.rs
|
||||
pub mod crypto;
|
||||
pub mod error;
|
||||
|
||||
pub use crypto::{derive_master_key, KdfParams};
|
||||
pub use error::{IdfotoError, Result};
|
||||
pub use error::{RelicarioError, Result};
|
||||
```
|
||||
|
||||
- [ ] **Step 6: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/
|
||||
git add crates/relicario-core/src/
|
||||
git commit -m "feat: add Argon2id key derivation with tests"
|
||||
```
|
||||
|
||||
@@ -415,11 +415,11 @@ git commit -m "feat: add Argon2id key derivation with tests"
|
||||
### Task 4: Crypto — Encrypt / Decrypt
|
||||
|
||||
**Files:**
|
||||
- Modify: `crates/idfoto-core/src/crypto.rs`
|
||||
- Modify: `crates/relicario-core/src/crypto.rs`
|
||||
|
||||
- [ ] **Step 1: Write the failing tests**
|
||||
|
||||
Add to `crates/idfoto-core/src/crypto.rs` inside the `mod tests` block:
|
||||
Add to `crates/relicario-core/src/crypto.rs` inside the `mod tests` block:
|
||||
|
||||
```rust
|
||||
#[test]
|
||||
@@ -471,12 +471,12 @@ Add to `crates/idfoto-core/src/crypto.rs` inside the `mod tests` block:
|
||||
|
||||
- [ ] **Step 2: Run tests to verify they fail**
|
||||
|
||||
Run: `cargo test -p idfoto-core encrypt`
|
||||
Run: `cargo test -p relicario-core encrypt`
|
||||
Expected: FAIL — `encrypt` and `decrypt` not defined.
|
||||
|
||||
- [ ] **Step 3: Write the implementation**
|
||||
|
||||
Add to `crates/idfoto-core/src/crypto.rs`, above the `#[cfg(test)]` block:
|
||||
Add to `crates/relicario-core/src/crypto.rs`, above the `#[cfg(test)]` block:
|
||||
|
||||
```rust
|
||||
use chacha20poly1305::{
|
||||
@@ -503,7 +503,7 @@ pub fn encrypt(key: &[u8; 32], plaintext: &[u8]) -> Result<Vec<u8>> {
|
||||
|
||||
let ciphertext = cipher
|
||||
.encrypt(nonce, plaintext)
|
||||
.map_err(|_| IdfotoError::Encrypt("XChaCha20-Poly1305 encryption failed".into()))?;
|
||||
.map_err(|_| RelicarioError::Encrypt("XChaCha20-Poly1305 encryption failed".into()))?;
|
||||
|
||||
let mut output = Vec::with_capacity(1 + NONCE_SIZE + ciphertext.len());
|
||||
output.push(FORMAT_VERSION);
|
||||
@@ -518,7 +518,7 @@ pub fn encrypt(key: &[u8; 32], plaintext: &[u8]) -> Result<Vec<u8>> {
|
||||
pub fn decrypt(key: &[u8; 32], data: &[u8]) -> Result<Vec<u8>> {
|
||||
let min_len = 1 + NONCE_SIZE + 16; // version + nonce + tag (empty plaintext)
|
||||
if data.len() < min_len {
|
||||
return Err(IdfotoError::Format(format!(
|
||||
return Err(RelicarioError::Format(format!(
|
||||
"ciphertext too short: {} bytes, need at least {}",
|
||||
data.len(),
|
||||
min_len
|
||||
@@ -527,7 +527,7 @@ pub fn decrypt(key: &[u8; 32], data: &[u8]) -> Result<Vec<u8>> {
|
||||
|
||||
let version = data[0];
|
||||
if version != FORMAT_VERSION {
|
||||
return Err(IdfotoError::Format(format!(
|
||||
return Err(RelicarioError::Format(format!(
|
||||
"unsupported format version: {version}"
|
||||
)));
|
||||
}
|
||||
@@ -538,7 +538,7 @@ pub fn decrypt(key: &[u8; 32], data: &[u8]) -> Result<Vec<u8>> {
|
||||
let cipher = XChaCha20Poly1305::new(key.into());
|
||||
cipher
|
||||
.decrypt(nonce, ciphertext)
|
||||
.map_err(|_| IdfotoError::Decrypt)
|
||||
.map_err(|_| RelicarioError::Decrypt)
|
||||
}
|
||||
```
|
||||
|
||||
@@ -557,24 +557,24 @@ use rand::RngCore;
|
||||
|
||||
- [ ] **Step 5: Run all crypto tests**
|
||||
|
||||
Run: `cargo test -p idfoto-core`
|
||||
Run: `cargo test -p relicario-core`
|
||||
Expected: All tests PASS (3 KDF tests + 4 encrypt/decrypt tests).
|
||||
|
||||
- [ ] **Step 6: Update lib.rs exports**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/lib.rs
|
||||
// crates/relicario-core/src/lib.rs
|
||||
pub mod crypto;
|
||||
pub mod error;
|
||||
|
||||
pub use crypto::{derive_master_key, encrypt, decrypt, KdfParams};
|
||||
pub use error::{IdfotoError, Result};
|
||||
pub use error::{RelicarioError, Result};
|
||||
```
|
||||
|
||||
- [ ] **Step 7: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/
|
||||
git add crates/relicario-core/src/
|
||||
git commit -m "feat: add XChaCha20-Poly1305 encrypt/decrypt with binary format"
|
||||
```
|
||||
|
||||
@@ -583,13 +583,13 @@ git commit -m "feat: add XChaCha20-Poly1305 encrypt/decrypt with binary format"
|
||||
### Task 5: Entry & Manifest Data Model
|
||||
|
||||
**Files:**
|
||||
- Create: `crates/idfoto-core/src/entry.rs`
|
||||
- Modify: `crates/idfoto-core/src/lib.rs`
|
||||
- Create: `crates/relicario-core/src/entry.rs`
|
||||
- Modify: `crates/relicario-core/src/lib.rs`
|
||||
|
||||
- [ ] **Step 1: Write tests for serialization**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/entry.rs
|
||||
// crates/relicario-core/src/entry.rs
|
||||
|
||||
// ... (implementation in step 3)
|
||||
|
||||
@@ -663,13 +663,13 @@ mod tests {
|
||||
|
||||
- [ ] **Step 2: Run tests to verify they fail**
|
||||
|
||||
Run: `cargo test -p idfoto-core entry`
|
||||
Run: `cargo test -p relicario-core entry`
|
||||
Expected: FAIL — types not defined.
|
||||
|
||||
- [ ] **Step 3: Write the implementation**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/entry.rs
|
||||
// crates/relicario-core/src/entry.rs
|
||||
use rand::Rng;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::collections::HashMap;
|
||||
@@ -850,25 +850,25 @@ mod tests {
|
||||
- [ ] **Step 4: Update lib.rs**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/lib.rs
|
||||
// crates/relicario-core/src/lib.rs
|
||||
pub mod crypto;
|
||||
pub mod entry;
|
||||
pub mod error;
|
||||
|
||||
pub use crypto::{derive_master_key, decrypt, encrypt, KdfParams};
|
||||
pub use entry::{generate_entry_id, Entry, Manifest, ManifestEntry};
|
||||
pub use error::{IdfotoError, Result};
|
||||
pub use error::{RelicarioError, Result};
|
||||
```
|
||||
|
||||
- [ ] **Step 5: Run tests**
|
||||
|
||||
Run: `cargo test -p idfoto-core entry`
|
||||
Run: `cargo test -p relicario-core entry`
|
||||
Expected: All 5 entry tests PASS.
|
||||
|
||||
- [ ] **Step 6: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/
|
||||
git add crates/relicario-core/src/
|
||||
git commit -m "feat: add Entry, Manifest, ManifestEntry data model with serde"
|
||||
```
|
||||
|
||||
@@ -877,13 +877,13 @@ git commit -m "feat: add Entry, Manifest, ManifestEntry data model with serde"
|
||||
### Task 6: Vault Operations
|
||||
|
||||
**Files:**
|
||||
- Create: `crates/idfoto-core/src/vault.rs`
|
||||
- Modify: `crates/idfoto-core/src/lib.rs`
|
||||
- Create: `crates/relicario-core/src/vault.rs`
|
||||
- Modify: `crates/relicario-core/src/lib.rs`
|
||||
|
||||
- [ ] **Step 1: Write failing tests**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/vault.rs
|
||||
// crates/relicario-core/src/vault.rs
|
||||
|
||||
// ... (implementation in step 3)
|
||||
|
||||
@@ -955,13 +955,13 @@ mod tests {
|
||||
|
||||
- [ ] **Step 2: Run tests to verify they fail**
|
||||
|
||||
Run: `cargo test -p idfoto-core vault`
|
||||
Run: `cargo test -p relicario-core vault`
|
||||
Expected: FAIL — functions not defined.
|
||||
|
||||
- [ ] **Step 3: Write the implementation**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/vault.rs
|
||||
// crates/relicario-core/src/vault.rs
|
||||
use crate::crypto;
|
||||
use crate::entry::{Entry, Manifest};
|
||||
use crate::error::Result;
|
||||
@@ -1061,7 +1061,7 @@ mod tests {
|
||||
- [ ] **Step 4: Update lib.rs**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/lib.rs
|
||||
// crates/relicario-core/src/lib.rs
|
||||
pub mod crypto;
|
||||
pub mod entry;
|
||||
pub mod error;
|
||||
@@ -1069,19 +1069,19 @@ pub mod vault;
|
||||
|
||||
pub use crypto::{derive_master_key, decrypt, encrypt, KdfParams};
|
||||
pub use entry::{generate_entry_id, Entry, Manifest, ManifestEntry};
|
||||
pub use error::{IdfotoError, Result};
|
||||
pub use error::{RelicarioError, Result};
|
||||
pub use vault::{decrypt_entry, decrypt_manifest, encrypt_entry, encrypt_manifest};
|
||||
```
|
||||
|
||||
- [ ] **Step 5: Run all tests**
|
||||
|
||||
Run: `cargo test -p idfoto-core`
|
||||
Run: `cargo test -p relicario-core`
|
||||
Expected: All tests PASS (KDF + encrypt/decrypt + entry + vault).
|
||||
|
||||
- [ ] **Step 6: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/
|
||||
git add crates/relicario-core/src/
|
||||
git commit -m "feat: add vault encrypt/decrypt for entries and manifest"
|
||||
```
|
||||
|
||||
@@ -1090,15 +1090,15 @@ git commit -m "feat: add vault encrypt/decrypt for entries and manifest"
|
||||
### Task 7: imgsecret — JPEG Decode, Y Channel, Block DCT
|
||||
|
||||
**Files:**
|
||||
- Create: `crates/idfoto-core/src/imgsecret.rs`
|
||||
- Modify: `crates/idfoto-core/src/lib.rs`
|
||||
- Create: `crates/relicario-core/src/imgsecret.rs`
|
||||
- Modify: `crates/relicario-core/src/lib.rs`
|
||||
|
||||
This task builds the image-processing foundation. No embedding yet — just: load JPEG → extract luminance → divide into 8×8 blocks → DCT forward/inverse.
|
||||
|
||||
- [ ] **Step 1: Write tests for DCT round-trip and Y channel extraction**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/imgsecret.rs
|
||||
// crates/relicario-core/src/imgsecret.rs
|
||||
|
||||
// ... (implementation in step 3)
|
||||
|
||||
@@ -1179,14 +1179,14 @@ mod tests {
|
||||
|
||||
- [ ] **Step 2: Run tests to verify they fail**
|
||||
|
||||
Run: `cargo test -p idfoto-core imgsecret`
|
||||
Run: `cargo test -p relicario-core imgsecret`
|
||||
Expected: FAIL — functions not defined.
|
||||
|
||||
- [ ] **Step 3: Write the implementation**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/imgsecret.rs
|
||||
use crate::error::{IdfotoError, Result};
|
||||
// crates/relicario-core/src/imgsecret.rs
|
||||
use crate::error::{RelicarioError, Result};
|
||||
use image::io::Reader as ImageReader;
|
||||
use std::f64::consts::PI;
|
||||
use std::io::Cursor;
|
||||
@@ -1214,11 +1214,11 @@ pub struct EmbedRegion {
|
||||
pub fn extract_y_channel(jpeg_bytes: &[u8]) -> Result<YChannel> {
|
||||
let reader = ImageReader::new(Cursor::new(jpeg_bytes))
|
||||
.with_guessed_format()
|
||||
.map_err(|e| IdfotoError::ImgSecret(format!("failed to read image: {e}")))?;
|
||||
.map_err(|e| RelicarioError::ImgSecret(format!("failed to read image: {e}")))?;
|
||||
|
||||
let img = reader
|
||||
.decode()
|
||||
.map_err(|e| IdfotoError::ImgSecret(format!("failed to decode image: {e}")))?;
|
||||
.map_err(|e| RelicarioError::ImgSecret(format!("failed to decode image: {e}")))?;
|
||||
|
||||
let rgb = img.to_rgb8();
|
||||
let (width, height) = (rgb.width() as usize, rgb.height() as usize);
|
||||
@@ -1464,7 +1464,7 @@ mod tests {
|
||||
- [ ] **Step 4: Update lib.rs**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/src/lib.rs
|
||||
// crates/relicario-core/src/lib.rs
|
||||
pub mod crypto;
|
||||
pub mod entry;
|
||||
pub mod error;
|
||||
@@ -1473,19 +1473,19 @@ pub mod vault;
|
||||
|
||||
pub use crypto::{derive_master_key, decrypt, encrypt, KdfParams};
|
||||
pub use entry::{generate_entry_id, Entry, Manifest, ManifestEntry};
|
||||
pub use error::{IdfotoError, Result};
|
||||
pub use error::{RelicarioError, Result};
|
||||
pub use vault::{decrypt_entry, decrypt_manifest, encrypt_entry, encrypt_manifest};
|
||||
```
|
||||
|
||||
- [ ] **Step 5: Run tests**
|
||||
|
||||
Run: `cargo test -p idfoto-core imgsecret`
|
||||
Run: `cargo test -p relicario-core imgsecret`
|
||||
Expected: All 4 tests PASS.
|
||||
|
||||
- [ ] **Step 6: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/
|
||||
git add crates/relicario-core/src/
|
||||
git commit -m "feat: add imgsecret JPEG decode, Y channel extraction, and 8x8 DCT"
|
||||
```
|
||||
|
||||
@@ -1494,7 +1494,7 @@ git commit -m "feat: add imgsecret JPEG decode, Y channel extraction, and 8x8 DC
|
||||
### Task 8: imgsecret — QIM Embedding + Block Selection
|
||||
|
||||
**Files:**
|
||||
- Modify: `crates/idfoto-core/src/imgsecret.rs`
|
||||
- Modify: `crates/relicario-core/src/imgsecret.rs`
|
||||
|
||||
This task adds QIM (Quantization Index Modulation) for embedding/extracting individual bits in DCT coefficients, and the fixed geometric pattern for selecting which blocks carry data.
|
||||
|
||||
@@ -1544,7 +1544,7 @@ Add to `mod tests` in `imgsecret.rs`:
|
||||
|
||||
- [ ] **Step 2: Run tests to verify they fail**
|
||||
|
||||
Run: `cargo test -p idfoto-core qim`
|
||||
Run: `cargo test -p relicario-core qim`
|
||||
Expected: FAIL — `qim_embed`, `qim_extract`, `select_embed_blocks`, `QUANT_STEP` not defined.
|
||||
|
||||
- [ ] **Step 3: Write QIM and block selection implementation**
|
||||
@@ -1632,13 +1632,13 @@ pub fn select_embed_blocks(region: &EmbedRegion, target_count: usize) -> Vec<(us
|
||||
|
||||
- [ ] **Step 4: Run tests**
|
||||
|
||||
Run: `cargo test -p idfoto-core imgsecret`
|
||||
Run: `cargo test -p relicario-core imgsecret`
|
||||
Expected: All tests PASS (previous 4 + 3 new QIM/block-selection tests).
|
||||
|
||||
- [ ] **Step 5: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/imgsecret.rs
|
||||
git add crates/relicario-core/src/imgsecret.rs
|
||||
git commit -m "feat: add QIM bit embedding and fixed-pattern block selection"
|
||||
```
|
||||
|
||||
@@ -1647,7 +1647,7 @@ git commit -m "feat: add QIM bit embedding and fixed-pattern block selection"
|
||||
### Task 9: imgsecret — Full embed() and extract()
|
||||
|
||||
**Files:**
|
||||
- Modify: `crates/idfoto-core/src/imgsecret.rs`
|
||||
- Modify: `crates/relicario-core/src/imgsecret.rs`
|
||||
|
||||
This is the main event: the public `embed()` and `extract()` functions with redundancy coding and majority voting. Reed-Solomon is added in Task 10.
|
||||
|
||||
@@ -1697,7 +1697,7 @@ Add `use rand::Fill;` at the top of the test module for the random fill.
|
||||
|
||||
- [ ] **Step 2: Run tests to verify they fail**
|
||||
|
||||
Run: `cargo test -p idfoto-core embed_extract`
|
||||
Run: `cargo test -p relicario-core embed_extract`
|
||||
Expected: FAIL — `embed` and `extract` not defined.
|
||||
|
||||
- [ ] **Step 3: Write embed() implementation**
|
||||
@@ -1727,7 +1727,7 @@ pub fn embed(carrier_jpeg: &[u8], secret: &[u8; 32]) -> Result<Vec<u8>> {
|
||||
|
||||
// Check minimum size
|
||||
if y.width < MIN_DIMENSION as usize || y.height < MIN_DIMENSION as usize {
|
||||
return Err(IdfotoError::ImageTooSmall {
|
||||
return Err(RelicarioError::ImageTooSmall {
|
||||
min_width: MIN_DIMENSION,
|
||||
min_height: MIN_DIMENSION,
|
||||
actual_width: y.width as u32,
|
||||
@@ -1739,7 +1739,7 @@ pub fn embed(carrier_jpeg: &[u8], secret: &[u8; 32]) -> Result<Vec<u8>> {
|
||||
let num_copies = (total_blocks / BLOCKS_PER_COPY).min(50); // cap at 50 copies
|
||||
|
||||
if num_copies < MIN_COPIES {
|
||||
return Err(IdfotoError::ImgSecret(format!(
|
||||
return Err(RelicarioError::ImgSecret(format!(
|
||||
"image too small for embedding: only {num_copies} copies fit, need at least {MIN_COPIES}"
|
||||
)));
|
||||
}
|
||||
@@ -1793,7 +1793,7 @@ fn extract_at_offset(jpeg_bytes: &[u8], dx: isize, dy: isize) -> Result<[u8; 32]
|
||||
let new_x = region.x_offset as isize + dx;
|
||||
let new_y = region.y_offset as isize + dy;
|
||||
if new_x < 0 || new_y < 0 {
|
||||
return Err(IdfotoError::ExtractionFailed);
|
||||
return Err(RelicarioError::ExtractionFailed);
|
||||
}
|
||||
region.x_offset = new_x as usize;
|
||||
region.y_offset = new_y as usize;
|
||||
@@ -1808,7 +1808,7 @@ fn extract_at_offset(jpeg_bytes: &[u8], dx: isize, dy: isize) -> Result<[u8; 32]
|
||||
let num_copies = (total_blocks / BLOCKS_PER_COPY).min(50);
|
||||
|
||||
if num_copies < 1 {
|
||||
return Err(IdfotoError::ExtractionFailed);
|
||||
return Err(RelicarioError::ExtractionFailed);
|
||||
}
|
||||
|
||||
let blocks_needed = num_copies * BLOCKS_PER_COPY;
|
||||
@@ -1857,7 +1857,7 @@ fn extract_at_offset(jpeg_bytes: &[u8], dx: isize, dy: isize) -> Result<[u8; 32]
|
||||
let total_votes: u32 = bit_votes.iter().map(|v| v[0] + v[1]).sum();
|
||||
let min_confidence = total_votes * 3 / 4; // at least 75% of votes should agree
|
||||
if confidence < min_confidence {
|
||||
return Err(IdfotoError::ExtractionFailed);
|
||||
return Err(RelicarioError::ExtractionFailed);
|
||||
}
|
||||
|
||||
Ok(bits_to_bytes(&secret_bits))
|
||||
@@ -1894,11 +1894,11 @@ fn bits_to_bytes(bits: &[u8]) -> [u8; 32] {
|
||||
fn reconstruct_jpeg(original_jpeg: &[u8], y_modified: &YChannel) -> Result<Vec<u8>> {
|
||||
let reader = ImageReader::new(Cursor::new(original_jpeg))
|
||||
.with_guessed_format()
|
||||
.map_err(|e| IdfotoError::ImgSecret(format!("failed to read image: {e}")))?;
|
||||
.map_err(|e| RelicarioError::ImgSecret(format!("failed to read image: {e}")))?;
|
||||
|
||||
let img = reader
|
||||
.decode()
|
||||
.map_err(|e| IdfotoError::ImgSecret(format!("failed to decode image: {e}")))?;
|
||||
.map_err(|e| RelicarioError::ImgSecret(format!("failed to decode image: {e}")))?;
|
||||
|
||||
let rgb = img.to_rgb8();
|
||||
let (width, height) = (rgb.width(), rgb.height());
|
||||
@@ -1933,14 +1933,14 @@ fn reconstruct_jpeg(original_jpeg: &[u8], y_modified: &YChannel) -> Result<Vec<u
|
||||
let encoder = JpegEncoder::new_with_quality(&mut buf, 92);
|
||||
encoder
|
||||
.write_image(output.as_raw(), width, height, image::ExtendedColorType::Rgb8)
|
||||
.map_err(|e| IdfotoError::ImgSecret(format!("failed to encode JPEG: {e}")))?;
|
||||
.map_err(|e| RelicarioError::ImgSecret(format!("failed to encode JPEG: {e}")))?;
|
||||
Ok(buf)
|
||||
}
|
||||
```
|
||||
|
||||
- [ ] **Step 4: Run tests**
|
||||
|
||||
Run: `cargo test -p idfoto-core imgsecret -- --nocapture`
|
||||
Run: `cargo test -p relicario-core imgsecret -- --nocapture`
|
||||
Expected: All tests PASS including embed/extract round-trip.
|
||||
|
||||
- [ ] **Step 5: Add a JPEG recompression survival test**
|
||||
@@ -1976,13 +1976,13 @@ Add to `mod tests`:
|
||||
|
||||
- [ ] **Step 6: Run all tests**
|
||||
|
||||
Run: `cargo test -p idfoto-core`
|
||||
Run: `cargo test -p relicario-core`
|
||||
Expected: All tests PASS.
|
||||
|
||||
- [ ] **Step 7: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/imgsecret.rs
|
||||
git add crates/relicario-core/src/imgsecret.rs
|
||||
git commit -m "feat: add imgsecret embed/extract with redundancy and majority voting"
|
||||
```
|
||||
|
||||
@@ -1991,7 +1991,7 @@ git commit -m "feat: add imgsecret embed/extract with redundancy and majority vo
|
||||
### Task 10: imgsecret — Crop Recovery
|
||||
|
||||
**Files:**
|
||||
- Modify: `crates/idfoto-core/src/imgsecret.rs`
|
||||
- Modify: `crates/relicario-core/src/imgsecret.rs`
|
||||
|
||||
- [ ] **Step 1: Write failing crop test**
|
||||
|
||||
@@ -2033,7 +2033,7 @@ Add to `mod tests`:
|
||||
|
||||
- [ ] **Step 2: Run test to verify it fails**
|
||||
|
||||
Run: `cargo test -p idfoto-core crop`
|
||||
Run: `cargo test -p relicario-core crop`
|
||||
Expected: FAIL — `extract_with_crop_recovery` not defined.
|
||||
|
||||
- [ ] **Step 3: Write crop recovery implementation**
|
||||
@@ -2066,7 +2066,7 @@ pub fn extract_with_crop_recovery(jpeg_bytes: &[u8]) -> Result<[u8; 32]> {
|
||||
}
|
||||
}
|
||||
|
||||
Err(IdfotoError::ExtractionFailed)
|
||||
Err(RelicarioError::ExtractionFailed)
|
||||
}
|
||||
```
|
||||
|
||||
@@ -2110,19 +2110,19 @@ fn extract_with_crop_recovery(jpeg_bytes: &[u8]) -> Result<[u8; 32]> {
|
||||
}
|
||||
}
|
||||
|
||||
Err(IdfotoError::ExtractionFailed)
|
||||
Err(RelicarioError::ExtractionFailed)
|
||||
}
|
||||
```
|
||||
|
||||
- [ ] **Step 4: Run all imgsecret tests**
|
||||
|
||||
Run: `cargo test -p idfoto-core imgsecret -- --nocapture`
|
||||
Run: `cargo test -p relicario-core imgsecret -- --nocapture`
|
||||
Expected: All tests PASS including crop recovery.
|
||||
|
||||
- [ ] **Step 5: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/imgsecret.rs
|
||||
git add crates/relicario-core/src/imgsecret.rs
|
||||
git commit -m "feat: add crop recovery with multi-offset extraction search"
|
||||
```
|
||||
|
||||
@@ -2131,15 +2131,15 @@ git commit -m "feat: add crop recovery with multi-offset extraction search"
|
||||
### Task 11: CLI — Scaffolding, init, generate
|
||||
|
||||
**Files:**
|
||||
- Modify: `crates/idfoto-cli/src/main.rs`
|
||||
- Modify: `crates/relicario-cli/src/main.rs`
|
||||
|
||||
- [ ] **Step 1: Write the clap CLI structure**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-cli/src/main.rs
|
||||
// crates/relicario-cli/src/main.rs
|
||||
use anyhow::{Context, Result};
|
||||
use clap::{Parser, Subcommand};
|
||||
use idfoto_core::{
|
||||
use relicario_core::{
|
||||
decrypt_entry, decrypt_manifest, derive_master_key, encrypt_entry, encrypt_manifest,
|
||||
generate_entry_id, Entry, KdfParams, Manifest, ManifestEntry,
|
||||
};
|
||||
@@ -2148,7 +2148,7 @@ use std::path::{Path, PathBuf};
|
||||
use std::process::Command;
|
||||
|
||||
#[derive(Parser)]
|
||||
#[command(name = "idfoto", version, about = "Git-backed password manager with reference image authentication")]
|
||||
#[command(name = "relicario", version, about = "Git-backed password manager with reference image authentication")]
|
||||
struct Cli {
|
||||
#[command(subcommand)]
|
||||
command: Commands,
|
||||
@@ -2230,21 +2230,21 @@ fn vault_dir() -> PathBuf {
|
||||
PathBuf::from(".")
|
||||
}
|
||||
|
||||
fn idfoto_dir() -> PathBuf {
|
||||
vault_dir().join(".idfoto")
|
||||
fn relicario_dir() -> PathBuf {
|
||||
vault_dir().join(".relicario")
|
||||
}
|
||||
|
||||
fn read_salt() -> Result<[u8; 32]> {
|
||||
let bytes = fs::read(idfoto_dir().join("salt"))
|
||||
.context("failed to read .idfoto/salt — is this a vault directory?")?;
|
||||
let bytes = fs::read(relicario_dir().join("salt"))
|
||||
.context("failed to read .relicario/salt — is this a vault directory?")?;
|
||||
let mut salt = [0u8; 32];
|
||||
salt.copy_from_slice(&bytes);
|
||||
Ok(salt)
|
||||
}
|
||||
|
||||
fn read_params() -> Result<KdfParams> {
|
||||
let json = fs::read_to_string(idfoto_dir().join("params.json"))
|
||||
.context("failed to read .idfoto/params.json")?;
|
||||
let json = fs::read_to_string(relicario_dir().join("params.json"))
|
||||
.context("failed to read .relicario/params.json")?;
|
||||
Ok(serde_json::from_str(&json)?)
|
||||
}
|
||||
|
||||
@@ -2256,7 +2256,7 @@ fn unlock(image_path: &Path) -> Result<[u8; 32]> {
|
||||
let jpeg_bytes = fs::read(image_path)
|
||||
.context("failed to read reference image")?;
|
||||
|
||||
let image_secret = idfoto_core::imgsecret::extract(&jpeg_bytes)
|
||||
let image_secret = relicario_core::imgsecret::extract(&jpeg_bytes)
|
||||
.map_err(|e| anyhow::anyhow!("failed to extract image secret: {e}"))?;
|
||||
|
||||
let salt = read_salt()?;
|
||||
@@ -2268,9 +2268,9 @@ fn unlock(image_path: &Path) -> Result<[u8; 32]> {
|
||||
Ok(master_key)
|
||||
}
|
||||
|
||||
/// Get reference image path — from env var IDFOTO_IMAGE or prompt.
|
||||
/// Get reference image path — from env var RELICARIO_IMAGE or prompt.
|
||||
fn get_image_path() -> Result<PathBuf> {
|
||||
if let Ok(path) = std::env::var("IDFOTO_IMAGE") {
|
||||
if let Ok(path) = std::env::var("RELICARIO_IMAGE") {
|
||||
return Ok(PathBuf::from(path));
|
||||
}
|
||||
eprint!("Reference image path: ");
|
||||
@@ -2328,7 +2328,7 @@ fn cmd_init(image_path: &Path, output_path: &Path) -> Result<()> {
|
||||
rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut image_secret);
|
||||
|
||||
println!("Embedding secret into reference image...");
|
||||
let stego_jpeg = idfoto_core::imgsecret::embed(&carrier_jpeg, &image_secret)
|
||||
let stego_jpeg = relicario_core::imgsecret::embed(&carrier_jpeg, &image_secret)
|
||||
.map_err(|e| anyhow::anyhow!("failed to embed secret: {e}"))?;
|
||||
fs::write(output_path, &stego_jpeg)
|
||||
.context("failed to write reference image")?;
|
||||
@@ -2354,14 +2354,14 @@ fn cmd_init(image_path: &Path, output_path: &Path) -> Result<()> {
|
||||
.map_err(|e| anyhow::anyhow!("key derivation failed: {e}"))?;
|
||||
|
||||
// 5. Write vault structure
|
||||
fs::create_dir_all(idfoto_dir())?;
|
||||
fs::create_dir_all(relicario_dir())?;
|
||||
fs::create_dir_all(vault_dir().join("entries"))?;
|
||||
fs::write(idfoto_dir().join("salt"), salt)?;
|
||||
fs::write(relicario_dir().join("salt"), salt)?;
|
||||
fs::write(
|
||||
idfoto_dir().join("params.json"),
|
||||
relicario_dir().join("params.json"),
|
||||
serde_json::to_string_pretty(¶ms)?,
|
||||
)?;
|
||||
fs::write(idfoto_dir().join("devices.json"), "[]")?;
|
||||
fs::write(relicario_dir().join("devices.json"), "[]")?;
|
||||
|
||||
// 6. Write empty manifest
|
||||
let manifest = Manifest::new();
|
||||
@@ -2373,7 +2373,7 @@ fn cmd_init(image_path: &Path, output_path: &Path) -> Result<()> {
|
||||
// Add .gitignore
|
||||
fs::write(vault_dir().join(".gitignore"), "reference.jpg\n")?;
|
||||
|
||||
git_commit("feat: initialize idfoto vault")?;
|
||||
git_commit("feat: initialize relicario vault")?;
|
||||
|
||||
println!("\nVault initialized successfully!");
|
||||
println!("IMPORTANT: Keep your reference image ({}) safe — you need it to unlock the vault.", output_path.display());
|
||||
@@ -2664,7 +2664,7 @@ Expected: Shows all subcommands with descriptions.
|
||||
- [ ] **Step 5: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-cli/src/main.rs
|
||||
git add crates/relicario-cli/src/main.rs
|
||||
git commit -m "feat: add full CLI with init, add, get, list, edit, rm, sync, generate"
|
||||
```
|
||||
|
||||
@@ -2673,7 +2673,7 @@ git commit -m "feat: add full CLI with init, add, get, list, edit, rm, sync, gen
|
||||
### Task 12: CLI — Device Management
|
||||
|
||||
**Files:**
|
||||
- Modify: `crates/idfoto-cli/src/main.rs`
|
||||
- Modify: `crates/relicario-cli/src/main.rs`
|
||||
|
||||
- [ ] **Step 1: Add device subcommands to the CLI**
|
||||
|
||||
@@ -2733,14 +2733,14 @@ struct DeviceEntry {
|
||||
}
|
||||
|
||||
fn read_devices() -> Result<Vec<DeviceEntry>> {
|
||||
let json = fs::read_to_string(idfoto_dir().join("devices.json"))
|
||||
let json = fs::read_to_string(relicario_dir().join("devices.json"))
|
||||
.context("failed to read devices.json")?;
|
||||
Ok(serde_json::from_str(&json)?)
|
||||
}
|
||||
|
||||
fn write_devices(devices: &[DeviceEntry]) -> Result<()> {
|
||||
let json = serde_json::to_string_pretty(devices)?;
|
||||
fs::write(idfoto_dir().join("devices.json"), json)?;
|
||||
fs::write(relicario_dir().join("devices.json"), json)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -2759,7 +2759,7 @@ fn cmd_device_add(name: &str) -> Result<()> {
|
||||
// Save private key to local config
|
||||
let config_dir = dirs::config_dir()
|
||||
.context("no config directory")?
|
||||
.join("idfoto");
|
||||
.join("relicario");
|
||||
fs::create_dir_all(&config_dir)?;
|
||||
fs::write(
|
||||
config_dir.join(format!("{name}.key")),
|
||||
@@ -2806,7 +2806,7 @@ fn cmd_device_revoke(name: &str) -> Result<()> {
|
||||
|
||||
- [ ] **Step 3: Add hex dependency**
|
||||
|
||||
Add to `crates/idfoto-cli/Cargo.toml` under `[dependencies]`:
|
||||
Add to `crates/relicario-cli/Cargo.toml` under `[dependencies]`:
|
||||
|
||||
```toml
|
||||
hex = "0.4"
|
||||
@@ -2824,7 +2824,7 @@ Expected: Compiles cleanly.
|
||||
- [ ] **Step 5: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-cli/
|
||||
git add crates/relicario-cli/
|
||||
git commit -m "feat: add device add/list/revoke commands with ed25519 key management"
|
||||
```
|
||||
|
||||
@@ -2833,16 +2833,16 @@ git commit -m "feat: add device add/list/revoke commands with ed25519 key manage
|
||||
### Task 13: Integration Test — Full Vault Workflow
|
||||
|
||||
**Files:**
|
||||
- Create: `crates/idfoto-core/tests/integration.rs`
|
||||
- Create: `crates/relicario-core/tests/integration.rs`
|
||||
|
||||
This test exercises the full flow: generate secret → embed → derive key → encrypt entry → decrypt entry → extract secret from re-encoded image.
|
||||
|
||||
- [ ] **Step 1: Write the integration test**
|
||||
|
||||
```rust
|
||||
// crates/idfoto-core/tests/integration.rs
|
||||
use idfoto_core::*;
|
||||
use idfoto_core::imgsecret;
|
||||
// crates/relicario-core/tests/integration.rs
|
||||
use relicario_core::*;
|
||||
use relicario_core::imgsecret;
|
||||
|
||||
fn make_test_jpeg(width: u32, height: u32) -> Vec<u8> {
|
||||
use image::codecs::jpeg::JpegEncoder;
|
||||
@@ -2967,7 +2967,7 @@ fn two_factor_independence() {
|
||||
|
||||
- [ ] **Step 2: Run integration tests**
|
||||
|
||||
Run: `cargo test -p idfoto-core --test integration`
|
||||
Run: `cargo test -p relicario-core --test integration`
|
||||
Expected: Both tests PASS.
|
||||
|
||||
- [ ] **Step 3: Run the full test suite**
|
||||
@@ -2978,7 +2978,7 @@ Expected: ALL tests across all crates PASS.
|
||||
- [ ] **Step 4: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/tests/
|
||||
git add crates/relicario-core/tests/
|
||||
git commit -m "test: add full-workflow integration test and two-factor independence verification"
|
||||
```
|
||||
|
||||
@@ -2987,7 +2987,7 @@ git commit -m "test: add full-workflow integration test and two-factor independe
|
||||
## Plan 2 Preview
|
||||
|
||||
After this plan is complete and passing, Plan 2 covers:
|
||||
- **idfoto-wasm**: wasm-bindgen wrapper around idfoto-core (compile with `wasm-pack build`)
|
||||
- **relicario-wasm**: wasm-bindgen wrapper around relicario-core (compile with `wasm-pack build`)
|
||||
- **Chrome MV3 extension**: TypeScript popup + content script + service worker, loading the WASM module for inline crypto
|
||||
- **Extension UX**: passphrase prompt, entry list/search, autofill detection
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# idfoto Credential Capture Implementation Plan
|
||||
# relicario Credential Capture Implementation Plan
|
||||
|
||||
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
|
||||
**Tech Stack:** TypeScript, Chrome extension APIs, DOM injection
|
||||
|
||||
**Spec:** `docs/superpowers/specs/2026-04-12-idfoto-credential-capture-design.md`
|
||||
**Spec:** `docs/superpowers/specs/2026-04-12-relicario-credential-capture-design.md`
|
||||
|
||||
---
|
||||
|
||||
@@ -24,7 +24,7 @@ extension/src/popup/components/settings.ts # Settings view
|
||||
### Modified files
|
||||
|
||||
```
|
||||
extension/src/shared/types.ts # Add IdfotoSettings interface
|
||||
extension/src/shared/types.ts # Add RelicarioSettings interface
|
||||
extension/src/shared/messages.ts # Add new message types
|
||||
extension/src/service-worker/index.ts # Handle new messages
|
||||
extension/src/content/detector.ts # Import and init capture
|
||||
@@ -40,17 +40,17 @@ extension/src/popup/components/unlock.ts # Wire settings button to settings vie
|
||||
- Modify: `extension/src/shared/types.ts`
|
||||
- Modify: `extension/src/shared/messages.ts`
|
||||
|
||||
- [ ] **Step 1: Add IdfotoSettings to types.ts**
|
||||
- [ ] **Step 1: Add RelicarioSettings to types.ts**
|
||||
|
||||
Add at the end of `extension/src/shared/types.ts`:
|
||||
|
||||
```typescript
|
||||
export interface IdfotoSettings {
|
||||
export interface RelicarioSettings {
|
||||
captureEnabled: boolean;
|
||||
captureStyle: 'bar' | 'toast';
|
||||
}
|
||||
|
||||
export const DEFAULT_SETTINGS: IdfotoSettings = {
|
||||
export const DEFAULT_SETTINGS: RelicarioSettings = {
|
||||
captureEnabled: false,
|
||||
captureStyle: 'bar',
|
||||
};
|
||||
@@ -64,7 +64,7 @@ Add these to the `Request` union in `extension/src/shared/messages.ts`:
|
||||
| { type: 'check_credential'; url: string; username: string; password: string }
|
||||
| { type: 'blacklist_site'; hostname: string }
|
||||
| { type: 'get_settings' }
|
||||
| { type: 'update_settings'; settings: Partial<import('./types').IdfotoSettings> }
|
||||
| { type: 'update_settings'; settings: Partial<import('./types').RelicarioSettings> }
|
||||
| { type: 'get_blacklist' }
|
||||
| { type: 'remove_blacklist'; hostname: string }
|
||||
```
|
||||
@@ -88,16 +88,16 @@ git commit -m "feat: add settings and credential capture message types"
|
||||
Add these helper functions to `extension/src/service-worker/index.ts`, after the existing storage helpers:
|
||||
|
||||
```typescript
|
||||
import type { IdfotoSettings } from '../shared/types';
|
||||
import type { RelicarioSettings } from '../shared/types';
|
||||
import { DEFAULT_SETTINGS } from '../shared/types';
|
||||
|
||||
async function loadSettings(): Promise<IdfotoSettings> {
|
||||
async function loadSettings(): Promise<RelicarioSettings> {
|
||||
const data = await chrome.storage.local.get(['settings']);
|
||||
if (!data.settings) return { ...DEFAULT_SETTINGS };
|
||||
return { ...DEFAULT_SETTINGS, ...data.settings };
|
||||
}
|
||||
|
||||
async function saveSettings(settings: IdfotoSettings): Promise<void> {
|
||||
async function saveSettings(settings: RelicarioSettings): Promise<void> {
|
||||
await chrome.storage.local.set({ settings });
|
||||
}
|
||||
|
||||
@@ -356,9 +356,9 @@ export function hookForms(): void {
|
||||
|
||||
// --- Prompt UI ---
|
||||
|
||||
/// Remove any existing idfoto prompt from the page.
|
||||
/// Remove any existing relicario prompt from the page.
|
||||
function removePrompt(): void {
|
||||
document.getElementById('idfoto-capture-prompt')?.remove();
|
||||
document.getElementById('relicario-capture-prompt')?.remove();
|
||||
}
|
||||
|
||||
/// Show a save/update prompt.
|
||||
@@ -385,7 +385,7 @@ function showPrompt(
|
||||
: `Save login for ${hostname}?`;
|
||||
|
||||
const container = document.createElement('div');
|
||||
container.id = 'idfoto-capture-prompt';
|
||||
container.id = 'relicario-capture-prompt';
|
||||
|
||||
// Common styles
|
||||
const baseStyles = `
|
||||
@@ -451,7 +451,7 @@ function showPrompt(
|
||||
|
||||
// Brand label
|
||||
const brand = document.createElement('span');
|
||||
brand.textContent = 'idfoto';
|
||||
brand.textContent = 'relicario';
|
||||
brand.style.cssText = 'color: #58a6ff; font-weight: normal; letter-spacing: 1px;';
|
||||
|
||||
// Message text
|
||||
@@ -627,7 +627,7 @@ Create `extension/src/popup/components/settings.ts`:
|
||||
/// Settings view — configure credential capture and manage blacklist.
|
||||
|
||||
import { setState, sendMessage, navigate, escapeHtml } from '../popup';
|
||||
import type { IdfotoSettings } from '../../shared/types';
|
||||
import type { RelicarioSettings } from '../../shared/types';
|
||||
|
||||
export async function renderSettings(app: HTMLElement): Promise<void> {
|
||||
// Load current settings and blacklist in parallel.
|
||||
@@ -636,8 +636,8 @@ export async function renderSettings(app: HTMLElement): Promise<void> {
|
||||
sendMessage({ type: 'get_blacklist' }),
|
||||
]);
|
||||
|
||||
const settings: IdfotoSettings = settingsResp.ok
|
||||
? settingsResp.data as IdfotoSettings
|
||||
const settings: RelicarioSettings = settingsResp.ok
|
||||
? settingsResp.data as RelicarioSettings
|
||||
: { captureEnabled: false, captureStyle: 'bar' };
|
||||
|
||||
const blacklist: string[] = blacklistResp.ok
|
||||
@@ -1,4 +1,4 @@
|
||||
# idfoto Firefox Extension Port Implementation Plan
|
||||
# relicario Firefox Extension Port Implementation Plan
|
||||
|
||||
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
|
||||
**Tech Stack:** TypeScript, webpack, Firefox WebExtensions MV3
|
||||
|
||||
**Spec:** `docs/superpowers/specs/2026-04-12-idfoto-firefox-extension-design.md`
|
||||
**Spec:** `docs/superpowers/specs/2026-04-12-relicario-firefox-extension-design.md`
|
||||
|
||||
---
|
||||
|
||||
@@ -46,12 +46,12 @@ Create `extension/manifest.firefox.json`:
|
||||
```json
|
||||
{
|
||||
"manifest_version": 3,
|
||||
"name": "idfoto",
|
||||
"name": "relicario",
|
||||
"version": "0.1.0",
|
||||
"description": "Two-factor encrypted password manager",
|
||||
"browser_specific_settings": {
|
||||
"gecko": {
|
||||
"id": "idfoto@adlee.work",
|
||||
"id": "relicario@adlee.work",
|
||||
"strict_min_version": "128.0"
|
||||
}
|
||||
},
|
||||
@@ -84,8 +84,8 @@ Create `extension/manifest.firefox.json`:
|
||||
"setup.html",
|
||||
"setup.js",
|
||||
"styles.css",
|
||||
"idfoto_wasm_bg.wasm",
|
||||
"idfoto_wasm.js"
|
||||
"relicario_wasm_bg.wasm",
|
||||
"relicario_wasm.js"
|
||||
]
|
||||
}
|
||||
]
|
||||
@@ -126,8 +126,8 @@ module.exports = {
|
||||
{ from: 'src/popup/styles.css', to: 'styles.css' },
|
||||
{ from: 'setup.html', to: '.' },
|
||||
{ from: 'icons', to: 'icons' },
|
||||
{ from: 'wasm/idfoto_wasm_bg.wasm', to: '.' },
|
||||
{ from: 'wasm/idfoto_wasm.js', to: '.' },
|
||||
{ from: 'wasm/relicario_wasm_bg.wasm', to: '.' },
|
||||
{ from: 'wasm/relicario_wasm.js', to: '.' },
|
||||
],
|
||||
}),
|
||||
],
|
||||
@@ -147,7 +147,7 @@ In `extension/package.json`, update the `scripts` section:
|
||||
"build:all": "npm run build:wasm && npm run build && npm run build:firefox",
|
||||
"dev": "webpack --mode development --watch",
|
||||
"dev:firefox": "webpack --config webpack.firefox.config.js --mode development --watch",
|
||||
"build:wasm": "wasm-pack build ../crates/idfoto-wasm --target web --out-dir ../../extension/wasm"
|
||||
"build:wasm": "wasm-pack build ../crates/relicario-wasm --target web --out-dir ../../extension/wasm"
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -189,9 +189,9 @@ In `extension/src/service-worker/index.ts`, replace the current `initWasm` funct
|
||||
// (Chrome) and the default export (Firefox) are available.
|
||||
|
||||
// @ts-ignore TS2307 — resolved by webpack alias / copy
|
||||
import initDefault, { initSync } from '../../wasm/idfoto_wasm.js';
|
||||
import initDefault, { initSync } from '../../wasm/relicario_wasm.js';
|
||||
// @ts-ignore TS2307
|
||||
import * as wasmBindings from '../../wasm/idfoto_wasm.js';
|
||||
import * as wasmBindings from '../../wasm/relicario_wasm.js';
|
||||
|
||||
type WasmModule = typeof wasmBindings;
|
||||
let wasm: WasmModule | null = null;
|
||||
@@ -204,12 +204,12 @@ async function initWasm(): Promise<WasmModule> {
|
||||
|
||||
if (isServiceWorker) {
|
||||
// Chrome: fetch WASM binary and instantiate synchronously
|
||||
const wasmResponse = await fetch(chrome.runtime.getURL('idfoto_wasm_bg.wasm'));
|
||||
const wasmResponse = await fetch(chrome.runtime.getURL('relicario_wasm_bg.wasm'));
|
||||
const wasmBytes = await wasmResponse.arrayBuffer();
|
||||
initSync({ module: new WebAssembly.Module(wasmBytes) });
|
||||
} else {
|
||||
// Firefox: background script — dynamic init works
|
||||
const wasmUrl = chrome.runtime.getURL('idfoto_wasm_bg.wasm');
|
||||
const wasmUrl = chrome.runtime.getURL('relicario_wasm_bg.wasm');
|
||||
await initDefault(wasmUrl);
|
||||
}
|
||||
|
||||
@@ -225,13 +225,13 @@ async function initWasm(): Promise<WasmModule> {
|
||||
Change the doc comment at the top of the file (line 1) from:
|
||||
|
||||
```typescript
|
||||
/// Service worker entry point for the idfoto Chrome extension.
|
||||
/// Service worker entry point for the relicario Chrome extension.
|
||||
```
|
||||
|
||||
To:
|
||||
|
||||
```typescript
|
||||
/// Background script entry point for the idfoto browser extension.
|
||||
/// Background script entry point for the relicario browser extension.
|
||||
///
|
||||
/// In Chrome this runs as a service worker (MV3). In Firefox this runs
|
||||
/// as a persistent background script. WASM loading adapts automatically.
|
||||
@@ -1,14 +1,14 @@
|
||||
# idfoto Vault Initialization Wizard Implementation Plan
|
||||
# relicario Vault Initialization Wizard Implementation Plan
|
||||
|
||||
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
|
||||
|
||||
**Goal:** Build a browser-based wizard that creates a new idfoto vault, pushes it to Gitea/GitHub via API, downloads the reference image, and optionally configures the Chrome extension.
|
||||
**Goal:** Build a browser-based wizard that creates a new relicario vault, pushes it to Gitea/GitHub via API, downloads the reference image, and optionally configures the Chrome extension.
|
||||
|
||||
**Architecture:** Single HTML page (`extension/setup.html`) bundled by webpack as a new entry point. Reuses the existing git API layer and WASM module. New `embed_image_secret` function added to the WASM crate. The wizard runs entirely client-side — all crypto happens in the browser via WASM.
|
||||
|
||||
**Tech Stack:** TypeScript, wasm-bindgen (existing WASM crate), webpack, Chrome extension APIs
|
||||
|
||||
**Spec:** `docs/superpowers/specs/2026-04-12-idfoto-init-wizard-design.md`
|
||||
**Spec:** `docs/superpowers/specs/2026-04-12-relicario-init-wizard-design.md`
|
||||
|
||||
---
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
### Rust (modified)
|
||||
|
||||
```
|
||||
crates/idfoto-wasm/src/lib.rs # Add embed_image_secret function
|
||||
crates/relicario-wasm/src/lib.rs # Add embed_image_secret function
|
||||
```
|
||||
|
||||
### Extension (new)
|
||||
@@ -42,16 +42,16 @@ extension/manifest.json # Add web_accessible_resources for setup.html
|
||||
## Task 1: Add `embed_image_secret` to WASM Crate
|
||||
|
||||
**Files:**
|
||||
- Modify: `crates/idfoto-wasm/src/lib.rs`
|
||||
- Modify: `crates/relicario-wasm/src/lib.rs`
|
||||
|
||||
- [ ] **Step 1: Write the test**
|
||||
|
||||
Add to the `#[cfg(test)] mod tests` block in `crates/idfoto-wasm/src/lib.rs`:
|
||||
Add to the `#[cfg(test)] mod tests` block in `crates/relicario-wasm/src/lib.rs`:
|
||||
|
||||
```rust
|
||||
#[test]
|
||||
fn embed_then_extract_round_trip() {
|
||||
// Create a synthetic test JPEG (same approach as idfoto-core tests)
|
||||
// Create a synthetic test JPEG (same approach as relicario-core tests)
|
||||
use image::codecs::jpeg::JpegEncoder;
|
||||
use image::{ImageBuffer, ImageEncoder, Rgb};
|
||||
|
||||
@@ -81,12 +81,12 @@ fn embed_then_extract_round_trip() {
|
||||
|
||||
- [ ] **Step 2: Run test to verify it fails**
|
||||
|
||||
Run: `cargo test -p idfoto-wasm embed_then_extract`
|
||||
Run: `cargo test -p relicario-wasm embed_then_extract`
|
||||
Expected: FAIL — `embed_image_secret` not defined.
|
||||
|
||||
- [ ] **Step 3: Add `image` dev-dependency to Cargo.toml**
|
||||
|
||||
Add to `crates/idfoto-wasm/Cargo.toml` under `[dev-dependencies]`:
|
||||
Add to `crates/relicario-wasm/Cargo.toml` under `[dev-dependencies]`:
|
||||
|
||||
```toml
|
||||
[dev-dependencies]
|
||||
@@ -96,7 +96,7 @@ image = { version = "0.25", default-features = false, features = ["jpeg"] }
|
||||
|
||||
- [ ] **Step 4: Implement the function**
|
||||
|
||||
Add to `crates/idfoto-wasm/src/lib.rs`, after the `extract_image_secret` function:
|
||||
Add to `crates/relicario-wasm/src/lib.rs`, after the `extract_image_secret` function:
|
||||
|
||||
```rust
|
||||
/// Embed a 256-bit secret into a carrier JPEG image.
|
||||
@@ -111,25 +111,25 @@ pub fn embed_image_secret(carrier_jpeg: &[u8], secret: &[u8]) -> Result<Vec<u8>,
|
||||
let secret: [u8; 32] = secret
|
||||
.try_into()
|
||||
.map_err(|_| JsValue::from_str("secret must be exactly 32 bytes"))?;
|
||||
idfoto_core::imgsecret::embed(carrier_jpeg, &secret)
|
||||
relicario_core::imgsecret::embed(carrier_jpeg, &secret)
|
||||
.map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
}
|
||||
```
|
||||
|
||||
- [ ] **Step 5: Run test to verify it passes**
|
||||
|
||||
Run: `cargo test -p idfoto-wasm embed_then_extract`
|
||||
Run: `cargo test -p relicario-wasm embed_then_extract`
|
||||
Expected: PASS
|
||||
|
||||
- [ ] **Step 6: Rebuild WASM**
|
||||
|
||||
Run: `wasm-pack build crates/idfoto-wasm --target web --out-dir ../../extension/wasm`
|
||||
Run: `wasm-pack build crates/relicario-wasm --target web --out-dir ../../extension/wasm`
|
||||
Expected: Builds successfully.
|
||||
|
||||
- [ ] **Step 7: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-wasm/src/lib.rs crates/idfoto-wasm/Cargo.toml
|
||||
git add crates/relicario-wasm/src/lib.rs crates/relicario-wasm/Cargo.toml
|
||||
git commit -m "feat: add embed_image_secret to WASM crate"
|
||||
```
|
||||
|
||||
@@ -172,7 +172,7 @@ Create `extension/setup.html`:
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>idfoto — vault setup</title>
|
||||
<title>relicario — vault setup</title>
|
||||
<link rel="stylesheet" href="styles.css">
|
||||
<style>
|
||||
/* Override popup constraints for full-page layout */
|
||||
@@ -339,12 +339,12 @@ let state: WizardState = {
|
||||
|
||||
// --- WASM ---
|
||||
|
||||
type WasmModule = typeof import('idfoto-wasm');
|
||||
type WasmModule = typeof import('relicario-wasm');
|
||||
let wasm: WasmModule | null = null;
|
||||
|
||||
async function initWasm(): Promise<WasmModule> {
|
||||
if (wasm) return wasm;
|
||||
const mod = await import(/* webpackIgnore: true */ '../idfoto_wasm.js');
|
||||
const mod = await import(/* webpackIgnore: true */ '../relicario_wasm.js');
|
||||
await mod.default();
|
||||
wasm = mod;
|
||||
return mod;
|
||||
@@ -378,7 +378,7 @@ function render(): void {
|
||||
const stepNames = ['git host', 'connection', 'create vault', 'done'];
|
||||
|
||||
let html = `
|
||||
<div class="brand" style="font-size:18px;margin-bottom:4px">idfoto setup</div>
|
||||
<div class="brand" style="font-size:18px;margin-bottom:4px">relicario setup</div>
|
||||
<div class="wizard-step">step ${state.step} of 4 — ${stepNames[state.step - 1]}</div>
|
||||
<div class="progress-bar"><div class="progress-bar-fill" style="width:${(state.step / 4) * 100}%"></div></div>
|
||||
`;
|
||||
@@ -416,7 +416,7 @@ function renderStep1(): string {
|
||||
<ol>
|
||||
<li>Log in to your Gitea instance</li>
|
||||
<li>Click <code>+</code> → <code>New Repository</code></li>
|
||||
<li>Name it (e.g. <code>idfoto-vault</code>), leave it <strong>empty</strong> — no README, no .gitignore</li>
|
||||
<li>Name it (e.g. <code>relicario-vault</code>), leave it <strong>empty</strong> — no README, no .gitignore</li>
|
||||
<li>Go to <code>Settings</code> → <code>Applications</code> → <code>Manage Access Tokens</code></li>
|
||||
<li>Generate a new token with <code>repo</code> scope (read/write)</li>
|
||||
<li>Copy the token — you'll need it in the next step</li>
|
||||
@@ -425,7 +425,7 @@ function renderStep1(): string {
|
||||
<div class="label" style="margin-bottom:8px">GITHUB SETUP</div>
|
||||
<ol>
|
||||
<li>Go to <strong>github.com</strong> → <code>New Repository</code></li>
|
||||
<li>Name it (e.g. <code>idfoto-vault</code>), set to <strong>Private</strong>, leave it <strong>empty</strong> — no README, no .gitignore, no license</li>
|
||||
<li>Name it (e.g. <code>relicario-vault</code>), set to <strong>Private</strong>, leave it <strong>empty</strong> — no README, no .gitignore, no license</li>
|
||||
<li>Go to <code>Settings</code> → <code>Developer Settings</code> → <code>Personal Access Tokens</code> → <code>Fine-grained tokens</code></li>
|
||||
<li>Click <code>Generate new token</code></li>
|
||||
<li>Select <strong>only</strong> the vault repository under "Repository access"</li>
|
||||
@@ -534,7 +534,7 @@ function renderStep4(): string {
|
||||
</p>
|
||||
` : `
|
||||
<p class="secondary" style="font-size:11px;margin-bottom:8px">
|
||||
idfoto extension detected. Push your vault config to it?
|
||||
relicario extension detected. Push your vault config to it?
|
||||
</p>
|
||||
<button class="btn" data-action="push-to-extension">Configure Extension</button>
|
||||
`}
|
||||
@@ -543,7 +543,7 @@ function renderStep4(): string {
|
||||
<div class="form-group" style="margin-top:16px">
|
||||
<div class="label">EXTENSION SETUP</div>
|
||||
<p class="secondary" style="font-size:11px;margin-bottom:8px">
|
||||
Install the idfoto extension, then enter these details in the setup wizard:
|
||||
Install the relicario extension, then enter these details in the setup wizard:
|
||||
</p>
|
||||
<div class="config-blob" data-action="copy-config" title="Click to copy">
|
||||
${escapeHtml(JSON.stringify({
|
||||
@@ -796,9 +796,9 @@ async function createVault(): Promise<void> {
|
||||
const manifestEnc = w.encrypt_manifest(emptyManifest, masterKey);
|
||||
|
||||
// 7. Push vault files to repo
|
||||
await git.writeFile('.idfoto/salt', salt, 'feat: initialize idfoto vault');
|
||||
await git.writeFile('.idfoto/params.json', new TextEncoder().encode(paramsJson), 'chore: add KDF params');
|
||||
await git.writeFile('.idfoto/devices.json', new TextEncoder().encode('[]'), 'chore: add empty devices list');
|
||||
await git.writeFile('.relicario/salt', salt, 'feat: initialize relicario vault');
|
||||
await git.writeFile('.relicario/params.json', new TextEncoder().encode(paramsJson), 'chore: add KDF params');
|
||||
await git.writeFile('.relicario/devices.json', new TextEncoder().encode('[]'), 'chore: add empty devices list');
|
||||
await git.writeFile('manifest.enc', new Uint8Array(manifestEnc), 'feat: add encrypted manifest');
|
||||
}
|
||||
|
||||
@@ -872,7 +872,7 @@ Add to `extension/manifest.json`, after the `content_security_policy` block:
|
||||
|
||||
```json
|
||||
"web_accessible_resources": [{
|
||||
"resources": ["setup.html", "setup.js", "styles.css", "idfoto_wasm_bg.wasm", "idfoto_wasm.js"],
|
||||
"resources": ["setup.html", "setup.js", "styles.css", "relicario_wasm_bg.wasm", "relicario_wasm.js"],
|
||||
"matches": ["<all_urls>"]
|
||||
}]
|
||||
```
|
||||
@@ -901,7 +901,7 @@ git commit -m "feat: add setup wizard to webpack build and extension manifest"
|
||||
- [ ] **Step 1: Rebuild WASM**
|
||||
|
||||
```bash
|
||||
wasm-pack build crates/idfoto-wasm --target web --out-dir ../../extension/wasm
|
||||
wasm-pack build crates/relicario-wasm --target web --out-dir ../../extension/wasm
|
||||
```
|
||||
|
||||
- [ ] **Step 2: Rebuild extension**
|
||||
@@ -927,7 +927,7 @@ Expected: All tests pass (including the new `embed_then_extract_round_trip`).
|
||||
- Step 2: enter real host/token/repo, test connection works
|
||||
- Step 3: pick a JPEG, enter passphrase, create vault pushes files
|
||||
- Step 4: download reference image works, extension detection works
|
||||
4. Verify the vault repo now has `.idfoto/salt`, `.idfoto/params.json`, `.idfoto/devices.json`, `manifest.enc`
|
||||
4. Verify the vault repo now has `.relicario/salt`, `.relicario/params.json`, `.relicario/devices.json`, `manifest.enc`
|
||||
5. Open extension popup, unlock with passphrase — should work with the just-created vault
|
||||
|
||||
- [ ] **Step 5: Fix any issues found**
|
||||
@@ -1,14 +1,14 @@
|
||||
# idfoto WASM + Chrome MV3 Extension Implementation Plan
|
||||
# relicario WASM + Chrome MV3 Extension Implementation Plan
|
||||
|
||||
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
|
||||
|
||||
**Goal:** Compile `idfoto-core` to WASM and wrap it in a Chrome MV3 browser extension with a terminal-aesthetic popup, conservative autofill, and direct Gitea/GitHub API access.
|
||||
**Goal:** Compile `relicario-core` to WASM and wrap it in a Chrome MV3 browser extension with a terminal-aesthetic popup, conservative autofill, and direct Gitea/GitHub API access.
|
||||
|
||||
**Architecture:** Monolith service worker loads the WASM module and holds all state (master_key, cached manifest). Popup and content script are thin UI layers communicating via `chrome.runtime.sendMessage`. Vault data is fetched/committed directly via Gitea/GitHub REST APIs — no local clone, no CLI dependency.
|
||||
|
||||
**Tech Stack:** Rust + wasm-bindgen (WASM crate), TypeScript + webpack (extension), Chrome MV3 APIs
|
||||
|
||||
**Spec:** `docs/superpowers/specs/2026-04-12-idfoto-wasm-extension-design.md`
|
||||
**Spec:** `docs/superpowers/specs/2026-04-12-relicario-wasm-extension-design.md`
|
||||
|
||||
---
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
### Rust (new crate)
|
||||
|
||||
```
|
||||
crates/idfoto-wasm/
|
||||
crates/relicario-wasm/
|
||||
├── Cargo.toml
|
||||
└── src/
|
||||
└── lib.rs # wasm-bindgen wrappers + TOTP implementation
|
||||
@@ -26,8 +26,8 @@ crates/idfoto-wasm/
|
||||
### Rust (modified)
|
||||
|
||||
```
|
||||
crates/idfoto-core/src/entry.rs # Add group field to Entry and ManifestEntry
|
||||
Cargo.toml # Add idfoto-wasm to workspace members
|
||||
crates/relicario-core/src/entry.rs # Add group field to Entry and ManifestEntry
|
||||
Cargo.toml # Add relicario-wasm to workspace members
|
||||
```
|
||||
|
||||
### Extension (all new)
|
||||
@@ -73,13 +73,13 @@ extension/
|
||||
## Task 0: Add Heavy Comments to Existing Rust Code
|
||||
|
||||
**Files:**
|
||||
- Modify: `crates/idfoto-core/src/lib.rs`
|
||||
- Modify: `crates/idfoto-core/src/error.rs`
|
||||
- Modify: `crates/idfoto-core/src/crypto.rs`
|
||||
- Modify: `crates/idfoto-core/src/entry.rs`
|
||||
- Modify: `crates/idfoto-core/src/vault.rs`
|
||||
- Modify: `crates/idfoto-core/src/imgsecret.rs`
|
||||
- Modify: `crates/idfoto-cli/src/main.rs`
|
||||
- Modify: `crates/relicario-core/src/lib.rs`
|
||||
- Modify: `crates/relicario-core/src/error.rs`
|
||||
- Modify: `crates/relicario-core/src/crypto.rs`
|
||||
- Modify: `crates/relicario-core/src/entry.rs`
|
||||
- Modify: `crates/relicario-core/src/vault.rs`
|
||||
- Modify: `crates/relicario-core/src/imgsecret.rs`
|
||||
- Modify: `crates/relicario-cli/src/main.rs`
|
||||
|
||||
Add thorough documentation comments to all existing Rust code. Every public function, struct, field, constant, and non-trivial private function should have doc comments explaining what it does, why it exists, and any important constraints. Module-level docs should explain the module's role in the overall architecture.
|
||||
|
||||
@@ -96,9 +96,9 @@ Guidelines:
|
||||
- [ ] **Step 1: Add module-level docs and comments to `lib.rs`**
|
||||
|
||||
```rust
|
||||
//! # idfoto-core
|
||||
//! # relicario-core
|
||||
//!
|
||||
//! Platform-agnostic core library for the idfoto password manager.
|
||||
//! Platform-agnostic core library for the relicario password manager.
|
||||
//!
|
||||
//! This crate is deliberately bytes-in/bytes-out — no filesystem, no network,
|
||||
//! no git operations. This makes it portable to WASM (browser extension),
|
||||
@@ -174,7 +174,7 @@ Expected: All tests pass unchanged.
|
||||
- [ ] **Step 9: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/ crates/idfoto-cli/src/main.rs
|
||||
git add crates/relicario-core/src/ crates/relicario-cli/src/main.rs
|
||||
git commit -m "docs: add heavy documentation comments to all Rust code"
|
||||
```
|
||||
|
||||
@@ -183,14 +183,14 @@ git commit -m "docs: add heavy documentation comments to all Rust code"
|
||||
## Task 1: Add `group` Field to Core Data Model
|
||||
|
||||
**Files:**
|
||||
- Modify: `crates/idfoto-core/src/entry.rs`
|
||||
- Modify: `crates/idfoto-core/src/vault.rs` (test helpers)
|
||||
- Modify: `crates/idfoto-cli/src/main.rs` (Entry construction sites)
|
||||
- Test: `crates/idfoto-core/src/entry.rs` (inline tests)
|
||||
- Modify: `crates/relicario-core/src/entry.rs`
|
||||
- Modify: `crates/relicario-core/src/vault.rs` (test helpers)
|
||||
- Modify: `crates/relicario-cli/src/main.rs` (Entry construction sites)
|
||||
- Test: `crates/relicario-core/src/entry.rs` (inline tests)
|
||||
|
||||
- [ ] **Step 1: Add `group` field to `Entry` struct**
|
||||
|
||||
In `crates/idfoto-core/src/entry.rs`, add the field after `totp_secret`:
|
||||
In `crates/relicario-core/src/entry.rs`, add the field after `totp_secret`:
|
||||
|
||||
```rust
|
||||
pub struct Entry {
|
||||
@@ -232,7 +232,7 @@ pub struct ManifestEntry {
|
||||
|
||||
Update every place that constructs `Entry` or `ManifestEntry` to include `group: None`. These are:
|
||||
|
||||
In `crates/idfoto-core/src/entry.rs` tests — `entry_serialization_round_trip`, `manifest_add_and_lookup`, `manifest_serialization_round_trip`, `manifest_search_case_insensitive`:
|
||||
In `crates/relicario-core/src/entry.rs` tests — `entry_serialization_round_trip`, `manifest_add_and_lookup`, `manifest_serialization_round_trip`, `manifest_search_case_insensitive`:
|
||||
|
||||
```rust
|
||||
// Every Entry construction gets:
|
||||
@@ -242,7 +242,7 @@ group: None,
|
||||
group: None,
|
||||
```
|
||||
|
||||
In `crates/idfoto-core/src/vault.rs` tests — `sample_entry()` helper and `manifest_encrypt_decrypt_round_trip`:
|
||||
In `crates/relicario-core/src/vault.rs` tests — `sample_entry()` helper and `manifest_encrypt_decrypt_round_trip`:
|
||||
|
||||
```rust
|
||||
// sample_entry() gets:
|
||||
@@ -252,7 +252,7 @@ group: None,
|
||||
group: None,
|
||||
```
|
||||
|
||||
In `crates/idfoto-core/tests/integration.rs` — `full_vault_workflow()` Entry construction (line ~55) and ManifestEntry (line ~101):
|
||||
In `crates/relicario-core/tests/integration.rs` — `full_vault_workflow()` Entry construction (line ~55) and ManifestEntry (line ~101):
|
||||
|
||||
```rust
|
||||
// Entry construction gets:
|
||||
@@ -262,7 +262,7 @@ group: None,
|
||||
group: None,
|
||||
```
|
||||
|
||||
In `crates/idfoto-cli/src/main.rs` — `cmd_add()` Entry construction (line ~328), `cmd_add()` ManifestEntry (line ~349), `cmd_edit()` Entry construction (line ~513), `cmd_edit()` ManifestEntry (line ~536):
|
||||
In `crates/relicario-cli/src/main.rs` — `cmd_add()` Entry construction (line ~328), `cmd_add()` ManifestEntry (line ~349), `cmd_edit()` Entry construction (line ~513), `cmd_edit()` ManifestEntry (line ~536):
|
||||
|
||||
```rust
|
||||
// Every Entry construction gets:
|
||||
@@ -274,7 +274,7 @@ group: None,
|
||||
|
||||
- [ ] **Step 4: Add a test for backwards compatibility (deserialize without group)**
|
||||
|
||||
In `crates/idfoto-core/src/entry.rs` tests:
|
||||
In `crates/relicario-core/src/entry.rs` tests:
|
||||
|
||||
```rust
|
||||
#[test]
|
||||
@@ -329,35 +329,35 @@ Expected: All tests pass, including new backwards-compatibility tests.
|
||||
- [ ] **Step 6: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-core/src/entry.rs crates/idfoto-core/src/vault.rs crates/idfoto-core/tests/integration.rs crates/idfoto-cli/src/main.rs
|
||||
git add crates/relicario-core/src/entry.rs crates/relicario-core/src/vault.rs crates/relicario-core/tests/integration.rs crates/relicario-cli/src/main.rs
|
||||
git commit -m "feat: add group field to Entry and ManifestEntry"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Task 2: Create `idfoto-wasm` Crate
|
||||
## Task 2: Create `relicario-wasm` Crate
|
||||
|
||||
**Files:**
|
||||
- Create: `crates/idfoto-wasm/Cargo.toml`
|
||||
- Create: `crates/idfoto-wasm/src/lib.rs`
|
||||
- Create: `crates/relicario-wasm/Cargo.toml`
|
||||
- Create: `crates/relicario-wasm/src/lib.rs`
|
||||
- Modify: `Cargo.toml` (workspace members)
|
||||
|
||||
- [ ] **Step 1: Create Cargo.toml**
|
||||
|
||||
Create `crates/idfoto-wasm/Cargo.toml`:
|
||||
Create `crates/relicario-wasm/Cargo.toml`:
|
||||
|
||||
```toml
|
||||
[package]
|
||||
name = "idfoto-wasm"
|
||||
name = "relicario-wasm"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
description = "WASM bindings for idfoto password manager"
|
||||
description = "WASM bindings for relicario password manager"
|
||||
|
||||
[lib]
|
||||
crate-type = ["cdylib", "rlib"]
|
||||
|
||||
[dependencies]
|
||||
idfoto-core = { path = "../idfoto-core" }
|
||||
relicario-core = { path = "../relicario-core" }
|
||||
wasm-bindgen = "0.2"
|
||||
js-sys = "0.3"
|
||||
serde_json = "1"
|
||||
@@ -371,21 +371,21 @@ wasm-bindgen-test = "0.3"
|
||||
|
||||
- [ ] **Step 2: Add to workspace**
|
||||
|
||||
In root `Cargo.toml`, add `"crates/idfoto-wasm"` to the members list:
|
||||
In root `Cargo.toml`, add `"crates/relicario-wasm"` to the members list:
|
||||
|
||||
```toml
|
||||
[workspace]
|
||||
resolver = "2"
|
||||
members = [
|
||||
"crates/idfoto-core",
|
||||
"crates/idfoto-cli",
|
||||
"crates/idfoto-wasm",
|
||||
"crates/relicario-core",
|
||||
"crates/relicario-cli",
|
||||
"crates/relicario-wasm",
|
||||
]
|
||||
```
|
||||
|
||||
- [ ] **Step 3: Write the WASM wrapper**
|
||||
|
||||
Create `crates/idfoto-wasm/src/lib.rs`:
|
||||
Create `crates/relicario-wasm/src/lib.rs`:
|
||||
|
||||
```rust
|
||||
use wasm_bindgen::prelude::*;
|
||||
@@ -399,7 +399,7 @@ pub fn derive_master_key(
|
||||
salt: &[u8],
|
||||
params_json: &str,
|
||||
) -> Result<Vec<u8>, JsValue> {
|
||||
let params: idfoto_core::KdfParams =
|
||||
let params: relicario_core::KdfParams =
|
||||
serde_json::from_str(params_json).map_err(|e| JsValue::from_str(&e.to_string()))?;
|
||||
|
||||
let image_secret: [u8; 32] = image_secret
|
||||
@@ -409,7 +409,7 @@ pub fn derive_master_key(
|
||||
.try_into()
|
||||
.map_err(|_| JsValue::from_str("salt must be exactly 32 bytes"))?;
|
||||
|
||||
let key = idfoto_core::derive_master_key(passphrase.as_bytes(), &image_secret, &salt, ¶ms)
|
||||
let key = relicario_core::derive_master_key(passphrase.as_bytes(), &image_secret, &salt, ¶ms)
|
||||
.map_err(|e| JsValue::from_str(&e.to_string()))?;
|
||||
|
||||
Ok(key.to_vec())
|
||||
@@ -421,7 +421,7 @@ pub fn encrypt(plaintext: &[u8], key: &[u8]) -> Result<Vec<u8>, JsValue> {
|
||||
let key: [u8; 32] = key
|
||||
.try_into()
|
||||
.map_err(|_| JsValue::from_str("key must be exactly 32 bytes"))?;
|
||||
idfoto_core::crypto::encrypt(&key, plaintext).map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
relicario_core::crypto::encrypt(&key, plaintext).map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
}
|
||||
|
||||
/// Decrypt ciphertext with a 32-byte key. Returns plaintext bytes.
|
||||
@@ -430,14 +430,14 @@ pub fn decrypt(ciphertext: &[u8], key: &[u8]) -> Result<Vec<u8>, JsValue> {
|
||||
let key: [u8; 32] = key
|
||||
.try_into()
|
||||
.map_err(|_| JsValue::from_str("key must be exactly 32 bytes"))?;
|
||||
idfoto_core::crypto::decrypt(&key, ciphertext).map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
relicario_core::crypto::decrypt(&key, ciphertext).map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
}
|
||||
|
||||
/// Extract a 256-bit secret from a JPEG with an embedded secret.
|
||||
#[wasm_bindgen]
|
||||
pub fn extract_image_secret(jpeg_bytes: &[u8]) -> Result<Vec<u8>, JsValue> {
|
||||
let secret =
|
||||
idfoto_core::imgsecret::extract(jpeg_bytes).map_err(|e| JsValue::from_str(&e.to_string()))?;
|
||||
relicario_core::imgsecret::extract(jpeg_bytes).map_err(|e| JsValue::from_str(&e.to_string()))?;
|
||||
Ok(secret.to_vec())
|
||||
}
|
||||
|
||||
@@ -447,9 +447,9 @@ pub fn encrypt_entry(entry_json: &str, key: &[u8]) -> Result<Vec<u8>, JsValue> {
|
||||
let key: [u8; 32] = key
|
||||
.try_into()
|
||||
.map_err(|_| JsValue::from_str("key must be exactly 32 bytes"))?;
|
||||
let entry: idfoto_core::Entry =
|
||||
let entry: relicario_core::Entry =
|
||||
serde_json::from_str(entry_json).map_err(|e| JsValue::from_str(&e.to_string()))?;
|
||||
idfoto_core::encrypt_entry(&key, &entry).map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
relicario_core::encrypt_entry(&key, &entry).map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
}
|
||||
|
||||
/// Decrypt an entry from encrypted bytes. Returns JSON string.
|
||||
@@ -459,7 +459,7 @@ pub fn decrypt_entry(ciphertext: &[u8], key: &[u8]) -> Result<String, JsValue> {
|
||||
.try_into()
|
||||
.map_err(|_| JsValue::from_str("key must be exactly 32 bytes"))?;
|
||||
let entry =
|
||||
idfoto_core::decrypt_entry(&key, ciphertext).map_err(|e| JsValue::from_str(&e.to_string()))?;
|
||||
relicario_core::decrypt_entry(&key, ciphertext).map_err(|e| JsValue::from_str(&e.to_string()))?;
|
||||
serde_json::to_string(&entry).map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
}
|
||||
|
||||
@@ -469,9 +469,9 @@ pub fn encrypt_manifest(manifest_json: &str, key: &[u8]) -> Result<Vec<u8>, JsVa
|
||||
let key: [u8; 32] = key
|
||||
.try_into()
|
||||
.map_err(|_| JsValue::from_str("key must be exactly 32 bytes"))?;
|
||||
let manifest: idfoto_core::Manifest =
|
||||
let manifest: relicario_core::Manifest =
|
||||
serde_json::from_str(manifest_json).map_err(|e| JsValue::from_str(&e.to_string()))?;
|
||||
idfoto_core::encrypt_manifest(&key, &manifest).map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
relicario_core::encrypt_manifest(&key, &manifest).map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
}
|
||||
|
||||
/// Decrypt a manifest from encrypted bytes. Returns JSON string.
|
||||
@@ -480,7 +480,7 @@ pub fn decrypt_manifest(ciphertext: &[u8], key: &[u8]) -> Result<String, JsValue
|
||||
let key: [u8; 32] = key
|
||||
.try_into()
|
||||
.map_err(|_| JsValue::from_str("key must be exactly 32 bytes"))?;
|
||||
let manifest = idfoto_core::decrypt_manifest(&key, ciphertext)
|
||||
let manifest = relicario_core::decrypt_manifest(&key, ciphertext)
|
||||
.map_err(|e| JsValue::from_str(&e.to_string()))?;
|
||||
serde_json::to_string(&manifest).map_err(|e| JsValue::from_str(&e.to_string()))
|
||||
}
|
||||
@@ -618,27 +618,27 @@ mod tests {
|
||||
|
||||
- [ ] **Step 4: Verify it compiles**
|
||||
|
||||
Run: `cargo build -p idfoto-wasm`
|
||||
Run: `cargo build -p relicario-wasm`
|
||||
Expected: Compiles successfully.
|
||||
|
||||
- [ ] **Step 5: Run tests**
|
||||
|
||||
Run: `cargo test -p idfoto-wasm`
|
||||
Run: `cargo test -p relicario-wasm`
|
||||
Expected: All tests pass, including TOTP RFC 6238 test vectors.
|
||||
|
||||
- [ ] **Step 6: Test WASM compilation**
|
||||
|
||||
Run: `cargo install wasm-pack` (if not already installed), then:
|
||||
```bash
|
||||
wasm-pack build crates/idfoto-wasm --target web --out-dir ../../extension/wasm
|
||||
wasm-pack build crates/relicario-wasm --target web --out-dir ../../extension/wasm
|
||||
```
|
||||
Expected: Produces `extension/wasm/idfoto_wasm.js` and `extension/wasm/idfoto_wasm_bg.wasm`. Note the WASM binary size for later reference.
|
||||
Expected: Produces `extension/wasm/relicario_wasm.js` and `extension/wasm/relicario_wasm_bg.wasm`. Note the WASM binary size for later reference.
|
||||
|
||||
- [ ] **Step 7: Commit**
|
||||
|
||||
```bash
|
||||
git add crates/idfoto-wasm/ Cargo.toml extension/wasm/
|
||||
git commit -m "feat: add idfoto-wasm crate with wasm-bindgen wrappers and TOTP"
|
||||
git add crates/relicario-wasm/ Cargo.toml extension/wasm/
|
||||
git commit -m "feat: add relicario-wasm crate with wasm-bindgen wrappers and TOTP"
|
||||
```
|
||||
|
||||
---
|
||||
@@ -658,13 +658,13 @@ git commit -m "feat: add idfoto-wasm crate with wasm-bindgen wrappers and TOTP"
|
||||
|
||||
```json
|
||||
{
|
||||
"name": "idfoto-extension",
|
||||
"name": "relicario-extension",
|
||||
"version": "0.1.0",
|
||||
"private": true,
|
||||
"scripts": {
|
||||
"build": "webpack --mode production",
|
||||
"dev": "webpack --mode development --watch",
|
||||
"build:wasm": "wasm-pack build ../crates/idfoto-wasm --target web --out-dir ../../extension/wasm",
|
||||
"build:wasm": "wasm-pack build ../crates/relicario-wasm --target web --out-dir ../../extension/wasm",
|
||||
"build:all": "npm run build:wasm && npm run build"
|
||||
},
|
||||
"devDependencies": {
|
||||
@@ -682,13 +682,13 @@ Note: `@anthropic-ai/sdk` is NOT needed — remove that. The devDependencies sho
|
||||
|
||||
```json
|
||||
{
|
||||
"name": "idfoto-extension",
|
||||
"name": "relicario-extension",
|
||||
"version": "0.1.0",
|
||||
"private": true,
|
||||
"scripts": {
|
||||
"build": "webpack --mode production",
|
||||
"dev": "webpack --mode development --watch",
|
||||
"build:wasm": "wasm-pack build ../crates/idfoto-wasm --target web --out-dir ../../extension/wasm",
|
||||
"build:wasm": "wasm-pack build ../crates/relicario-wasm --target web --out-dir ../../extension/wasm",
|
||||
"build:all": "npm run build:wasm && npm run build"
|
||||
},
|
||||
"devDependencies": {
|
||||
@@ -706,13 +706,13 @@ Actually, strike that — no anthropic SDK. Final version:
|
||||
|
||||
```json
|
||||
{
|
||||
"name": "idfoto-extension",
|
||||
"name": "relicario-extension",
|
||||
"version": "0.1.0",
|
||||
"private": true,
|
||||
"scripts": {
|
||||
"build": "webpack --mode production",
|
||||
"dev": "webpack --mode development --watch",
|
||||
"build:wasm": "wasm-pack build ../crates/idfoto-wasm --target web --out-dir ../../extension/wasm",
|
||||
"build:wasm": "wasm-pack build ../crates/relicario-wasm --target web --out-dir ../../extension/wasm",
|
||||
"build:all": "npm run build:wasm && npm run build"
|
||||
},
|
||||
"devDependencies": {
|
||||
@@ -781,8 +781,8 @@ module.exports = {
|
||||
{ from: 'src/popup/index.html', to: 'popup.html' },
|
||||
{ from: 'src/popup/styles.css', to: 'styles.css' },
|
||||
{ from: 'icons', to: 'icons' },
|
||||
{ from: 'wasm/idfoto_wasm_bg.wasm', to: '.' },
|
||||
{ from: 'wasm/idfoto_wasm.js', to: '.' },
|
||||
{ from: 'wasm/relicario_wasm_bg.wasm', to: '.' },
|
||||
{ from: 'wasm/relicario_wasm.js', to: '.' },
|
||||
],
|
||||
}),
|
||||
],
|
||||
@@ -797,7 +797,7 @@ module.exports = {
|
||||
```json
|
||||
{
|
||||
"manifest_version": 3,
|
||||
"name": "idfoto",
|
||||
"name": "relicario",
|
||||
"version": "0.1.0",
|
||||
"description": "Two-factor encrypted password manager",
|
||||
"permissions": ["storage", "activeTab", "clipboardWrite"],
|
||||
@@ -838,7 +838,7 @@ Create `extension/src/popup/index.html`:
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=360">
|
||||
<link rel="stylesheet" href="styles.css">
|
||||
<title>idfoto</title>
|
||||
<title>relicario</title>
|
||||
</head>
|
||||
<body>
|
||||
<div id="app"></div>
|
||||
@@ -1286,15 +1286,15 @@ import type { GitHost } from './git-host';
|
||||
import type { Entry, Manifest, ManifestEntry } from '../shared/types';
|
||||
|
||||
// These will be set by the service worker index after WASM init
|
||||
let wasm: typeof import('../../wasm/idfoto_wasm');
|
||||
let wasm: typeof import('../../wasm/relicario_wasm');
|
||||
|
||||
export function setWasm(w: typeof wasm) {
|
||||
wasm = w;
|
||||
}
|
||||
|
||||
export async function fetchVaultMeta(git: GitHost): Promise<{ salt: Uint8Array; paramsJson: string }> {
|
||||
const salt = await git.readFile('.idfoto/salt');
|
||||
const paramsBytes = await git.readFile('.idfoto/params.json');
|
||||
const salt = await git.readFile('.relicario/salt');
|
||||
const paramsBytes = await git.readFile('.relicario/params.json');
|
||||
const paramsJson = new TextDecoder().decode(paramsBytes);
|
||||
return { salt, paramsJson };
|
||||
}
|
||||
@@ -1414,13 +1414,13 @@ import {
|
||||
let masterKey: Uint8Array | null = null;
|
||||
let manifest: Manifest | null = null;
|
||||
let gitHost: GitHost | null = null;
|
||||
let wasm: typeof import('../../wasm/idfoto_wasm') | null = null;
|
||||
let wasm: typeof import('../../wasm/relicario_wasm') | null = null;
|
||||
|
||||
// ─── WASM initialization ───────────────────────────────────────────────────
|
||||
|
||||
async function initWasm(): Promise<typeof import('../../wasm/idfoto_wasm')> {
|
||||
async function initWasm(): Promise<typeof import('../../wasm/relicario_wasm')> {
|
||||
if (wasm) return wasm;
|
||||
const mod = await import(/* webpackIgnore: true */ './idfoto_wasm.js');
|
||||
const mod = await import(/* webpackIgnore: true */ './relicario_wasm.js');
|
||||
await mod.default();
|
||||
wasm = mod;
|
||||
setWasm(mod);
|
||||
@@ -2118,7 +2118,7 @@ import { sendMessage, navigate } from '../popup';
|
||||
|
||||
export function renderUnlock(container: HTMLElement) {
|
||||
container.innerHTML = `
|
||||
<div class="brand">idfoto</div>
|
||||
<div class="brand">relicario</div>
|
||||
<div style="margin-top: 16px">
|
||||
<div class="label">PASSPHRASE</div>
|
||||
<input type="password" id="passphrase" placeholder="Enter passphrase..." autofocus>
|
||||
@@ -2181,7 +2181,7 @@ import type { ManifestEntry } from '../../shared/types';
|
||||
export async function renderEntryList(container: HTMLElement) {
|
||||
container.innerHTML = `
|
||||
<div class="header">
|
||||
<div class="brand">idfoto</div>
|
||||
<div class="brand">relicario</div>
|
||||
<div class="status">🔓 unlocked</div>
|
||||
</div>
|
||||
<div class="search-bar">
|
||||
@@ -2702,7 +2702,7 @@ export function renderSetupWizard(container: HTMLElement) {
|
||||
|
||||
function render() {
|
||||
container.innerHTML = `
|
||||
<div class="brand">idfoto setup</div>
|
||||
<div class="brand">relicario setup</div>
|
||||
<div class="wizard-step">step ${step} of 3 — ${['repository', 'reference image', 'test unlock'][step - 1]}</div>
|
||||
<div class="progress-bar"><div class="progress-bar-fill" style="width: ${(step / 3) * 100}%"></div></div>
|
||||
<div id="wizard-content"></div>
|
||||
@@ -3128,10 +3128,10 @@ function showPicker(
|
||||
passwordField: HTMLInputElement
|
||||
) {
|
||||
// Remove any existing picker
|
||||
document.querySelectorAll('.idfoto-picker').forEach((el) => el.remove());
|
||||
document.querySelectorAll('.relicario-picker').forEach((el) => el.remove());
|
||||
|
||||
const picker = document.createElement('div');
|
||||
picker.className = 'idfoto-picker';
|
||||
picker.className = 'relicario-picker';
|
||||
picker.style.cssText = `
|
||||
position: absolute;
|
||||
right: 0;
|
||||
@@ -3222,7 +3222,7 @@ git commit -m "feat: add content script with form detection, field icon, and aut
|
||||
|
||||
```bash
|
||||
# Build WASM
|
||||
wasm-pack build crates/idfoto-wasm --target web --out-dir ../../extension/wasm
|
||||
wasm-pack build crates/relicario-wasm --target web --out-dir ../../extension/wasm
|
||||
|
||||
# Install deps and build extension
|
||||
cd extension && npm install && npm run build
|
||||
@@ -3233,8 +3233,8 @@ Expected: `extension/dist/` contains all files needed to load as an unpacked Chr
|
||||
- [ ] **Step 2: Note the WASM binary size**
|
||||
|
||||
```bash
|
||||
ls -lh extension/wasm/idfoto_wasm_bg.wasm
|
||||
ls -lh extension/dist/idfoto_wasm_bg.wasm
|
||||
ls -lh extension/wasm/relicario_wasm_bg.wasm
|
||||
ls -lh extension/dist/relicario_wasm_bg.wasm
|
||||
```
|
||||
|
||||
Record the size for reference. If >2 MB uncompressed, consider optimizing later.
|
||||
@@ -3276,7 +3276,7 @@ git commit -m "feat: complete WASM + Chrome MV3 extension build"
|
||||
|------|-------------|--------------|
|
||||
| 0 | Add heavy comments to existing Rust code | None |
|
||||
| 1 | Add `group` field to core data model | Task 0 |
|
||||
| 2 | Create `idfoto-wasm` crate | Task 1 |
|
||||
| 2 | Create `relicario-wasm` crate | Task 1 |
|
||||
| 3 | Extension scaffolding | Task 2 |
|
||||
| 4 | Shared types and messages | Task 3 |
|
||||
| 5 | Git API layer | Task 4 |
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,10 +1,10 @@
|
||||
# idfoto — Design Specification
|
||||
# relicario — Design Specification
|
||||
|
||||
A git-backed, self-hostable password manager with a Rust core, CLI, and Chrome browser extension. The reference image as a DCT-embedded secret carrier is the core differentiator.
|
||||
|
||||
## Overview
|
||||
|
||||
idfoto is a password manager where vault decryption requires two independent factors: a passphrase the user memorizes and a reference JPEG that carries a 256-bit secret embedded via DCT steganography. The vault lives in a git repository (self-hosted on the user's own Gitea instance), and the server only ever sees opaque ciphertext. Compromise of either factor alone is insufficient to decrypt the vault.
|
||||
relicario is a password manager where vault decryption requires two independent factors: a passphrase the user memorizes and a reference JPEG that carries a 256-bit secret embedded via DCT steganography. The vault lives in a git repository (self-hosted on the user's own Gitea instance), and the server only ever sees opaque ciphertext. Compromise of either factor alone is insufficient to decrypt the vault.
|
||||
|
||||
Primary goals: portfolio project for adlee.work, architectural elegance, legibility-as-security (the README should read as the security proof), learning Rust, and fun to tinker with.
|
||||
|
||||
@@ -23,7 +23,7 @@ A collection of credentials (usernames, passwords, URLs, TOTP seeds, notes) belo
|
||||
| Stolen device | Filesystem: reference image, device key, cached vault | Decrypt vault | Attacker has image_secret but not passphrase. Argon2id makes brute-force expensive. |
|
||||
| Stolen device + weak passphrase | Same + feasible brute-force | Decrypt vault | Enforce minimum passphrase strength at vault creation. Universal worst case. |
|
||||
| Shoulder surfer | Observed passphrase | Decrypt vault (if they also get image) | Passphrase alone insufficient — still need image_secret. |
|
||||
| Credential stuffing | Leaked email/password from other breaches | Access user's accounts | idfoto generates unique passwords per site. Breach of site A doesn't compromise site B. |
|
||||
| Credential stuffing | Leaked email/password from other breaches | Access user's accounts | relicario generates unique passwords per site. Breach of site A doesn't compromise site B. |
|
||||
|
||||
### Out of scope
|
||||
|
||||
@@ -50,7 +50,7 @@ passphrase (user types, UTF-8 encoded)
|
||||
▼
|
||||
Argon2id(
|
||||
password = passphrase_bytes || image_secret_bytes, // concatenated, 32-byte secret appended
|
||||
salt = vault_salt, // 32 bytes, from .idfoto/salt
|
||||
salt = vault_salt, // 32 bytes, from .relicario/salt
|
||||
memory = 64 MiB,
|
||||
iterations = 3,
|
||||
parallelism = 4,
|
||||
@@ -79,7 +79,7 @@ With a 4-word diceware passphrase (~51 bits) and Argon2id at 64 MiB, brute-force
|
||||
Compared to competitors:
|
||||
- LastPass/Bitwarden: server breach exposes ~40-60 bits (master password only)
|
||||
- 1Password: server breach exposes password + 128-bit Secret Key
|
||||
- idfoto: server breach exposes password + 256-bit image_secret
|
||||
- relicario: server breach exposes password + 256-bit image_secret
|
||||
|
||||
### Authenticated encryption
|
||||
|
||||
@@ -103,7 +103,7 @@ Nonce is generated fresh (CSPRNG) on every write. Version byte allows future for
|
||||
|
||||
### KDF parameters
|
||||
|
||||
Stored in `.idfoto/params.json` (plaintext, committed). Configurable per-vault:
|
||||
Stored in `.relicario/params.json` (plaintext, committed). Configurable per-vault:
|
||||
- Default: `argon2_m=65536` (64 MiB), `argon2_t=3`, `argon2_p=4`
|
||||
- Users can increase for CLI-only use on powerful hardware
|
||||
- Enables future parameter upgrades without format changes
|
||||
@@ -177,13 +177,13 @@ Caller must normalize EXIF orientation before passing JPEG to embed/extract. EXI
|
||||
## Vault Format & Repo Layout
|
||||
|
||||
```
|
||||
idfoto-vault/
|
||||
relicario-vault/
|
||||
├── manifest.enc # encrypted JSON: entry index, vault metadata
|
||||
├── entries/
|
||||
│ ├── a1b2c3d4.enc # one encrypted entry per file, random hex ID
|
||||
│ ├── e5f6a7b8.enc
|
||||
│ └── ...
|
||||
└── .idfoto/
|
||||
└── .relicario/
|
||||
├── salt # 32 bytes, plaintext (prevents precomputation)
|
||||
├── params.json # Argon2id parameters, plaintext
|
||||
└── devices.json # authorized device ed25519 public keys, plaintext
|
||||
@@ -226,7 +226,7 @@ Flat schema. No nested objects, no folders, no tags for V1. Entry IDs are random
|
||||
|
||||
### Plaintext metadata
|
||||
|
||||
Stored in `.idfoto/` and committed to the repo:
|
||||
Stored in `.relicario/` and committed to the repo:
|
||||
- `salt`: 32 random bytes, generated once at vault creation
|
||||
- `params.json`: Argon2id tuning knobs (memory, iterations, parallelism, format version)
|
||||
- `devices.json`: list of authorized device ed25519 public keys, used to verify commit signatures
|
||||
@@ -244,20 +244,20 @@ Preserved as-is. Every add/edit/rm is a commit. Provides "when was this password
|
||||
## Crate Layout
|
||||
|
||||
```
|
||||
idfoto/
|
||||
relicario/
|
||||
├── Cargo.toml # workspace root
|
||||
├── crates/
|
||||
│ ├── idfoto-core/ # library: imgsecret, KDF, vault format
|
||||
│ ├── relicario-core/ # library: imgsecret, KDF, vault format
|
||||
│ │ └── src/
|
||||
│ │ ├── lib.rs
|
||||
│ │ ├── imgsecret.rs
|
||||
│ │ ├── kdf.rs
|
||||
│ │ ├── vault.rs
|
||||
│ │ └── entry.rs
|
||||
│ ├── idfoto-cli/ # binary: the `idfoto` CLI
|
||||
│ ├── relicario-cli/ # binary: the `relicario` CLI
|
||||
│ │ └── src/
|
||||
│ │ └── main.rs
|
||||
│ └── idfoto-wasm/ # wasm-bindgen wrapper around core
|
||||
│ └── relicario-wasm/ # wasm-bindgen wrapper around core
|
||||
│ └── src/
|
||||
│ └── lib.rs
|
||||
├── extension/ # TypeScript Chrome MV3 extension
|
||||
@@ -271,14 +271,14 @@ idfoto/
|
||||
|
||||
### Design principles
|
||||
|
||||
- **`idfoto-core` is platform-agnostic.** No filesystem, no git, no network. Takes bytes, returns bytes. This makes it trivially portable to WASM, Android (via JNI), iOS (via Swift bridge).
|
||||
- **`idfoto-cli`** is the platform layer. Handles filesystem, git operations (shells out to `git`), clipboard, terminal I/O.
|
||||
- **`idfoto-wasm`** is a thin wasm-bindgen wrapper exposing core functions to JavaScript.
|
||||
- **`relicario-core` is platform-agnostic.** No filesystem, no git, no network. Takes bytes, returns bytes. This makes it trivially portable to WASM, Android (via JNI), iOS (via Swift bridge).
|
||||
- **`relicario-cli`** is the platform layer. Handles filesystem, git operations (shells out to `git`), clipboard, terminal I/O.
|
||||
- **`relicario-wasm`** is a thin wasm-bindgen wrapper exposing core functions to JavaScript.
|
||||
- **`extension/`** is TypeScript/MV3. Loads the WASM module, runs crypto inline (no native messaging bridge).
|
||||
|
||||
### Rust crate dependencies (expected)
|
||||
|
||||
**idfoto-core:**
|
||||
**relicario-core:**
|
||||
- `argon2` — Argon2id KDF
|
||||
- `chacha20poly1305` — XChaCha20-Poly1305 AEAD
|
||||
- `sha2` — SHA-256 for hashing
|
||||
@@ -290,44 +290,44 @@ idfoto/
|
||||
- `ed25519-dalek` — device key signing (used by CLI, exposed via core)
|
||||
- `thiserror` — error types
|
||||
|
||||
**idfoto-cli:**
|
||||
**relicario-cli:**
|
||||
- `clap` (derive) — argument parsing
|
||||
- `anyhow` — CLI error handling
|
||||
- `rpassword` — passphrase prompt without echo
|
||||
- `arboard` or `cli-clipboard` — clipboard access
|
||||
- `dirs` — platform config/data directories
|
||||
|
||||
**idfoto-wasm:**
|
||||
**relicario-wasm:**
|
||||
- `wasm-bindgen` — JS interop
|
||||
- `js-sys`, `web-sys` — browser APIs
|
||||
|
||||
## CLI Commands
|
||||
|
||||
```
|
||||
idfoto init # Create vault: generate salt, prompt for passphrase,
|
||||
relicario init # Create vault: generate salt, prompt for passphrase,
|
||||
# prompt for carrier image, embed image_secret,
|
||||
# output reference JPEG, git init + first commit
|
||||
|
||||
idfoto add # Prompt for entry fields, encrypt, commit
|
||||
idfoto get <name> # Case-insensitive substring match on name/URL, decrypt, copy password to clipboard (30s TTL)
|
||||
idfoto list # Decrypt manifest, print entry names/URLs
|
||||
idfoto edit <name> # Decrypt entry, prompt for changes, re-encrypt, commit
|
||||
idfoto rm <name> # Remove entry file, update manifest, commit
|
||||
idfoto sync # git pull --rebase && git push
|
||||
idfoto generate # Generate a random password (utility, no vault interaction)
|
||||
relicario add # Prompt for entry fields, encrypt, commit
|
||||
relicario get <name> # Case-insensitive substring match on name/URL, decrypt, copy password to clipboard (30s TTL)
|
||||
relicario list # Decrypt manifest, print entry names/URLs
|
||||
relicario edit <name> # Decrypt entry, prompt for changes, re-encrypt, commit
|
||||
relicario rm <name> # Remove entry file, update manifest, commit
|
||||
relicario sync # git pull --rebase && git push
|
||||
relicario generate # Generate a random password (utility, no vault interaction)
|
||||
|
||||
idfoto device add # Generate ed25519 keypair, add pubkey to devices.json, commit
|
||||
idfoto device list # List authorized devices
|
||||
idfoto device revoke <name> # Remove device from devices.json, commit
|
||||
relicario device add # Generate ed25519 keypair, add pubkey to devices.json, commit
|
||||
relicario device list # List authorized devices
|
||||
relicario device revoke <name> # Remove device from devices.json, commit
|
||||
```
|
||||
|
||||
Unlock flow: on any command that needs the vault, the CLI prompts for the passphrase and the reference image path (or uses a configured default path). Derives master_key, holds it in memory for the duration of the command, then drops it. No persistent daemon for V1 — each invocation re-derives.
|
||||
|
||||
Future: `idfoto unlock` could spawn a background agent (ssh-agent-style) that holds the key for a configurable TTL, so subsequent commands don't re-prompt.
|
||||
Future: `relicario unlock` could spawn a background agent (ssh-agent-style) that holds the key for a configurable TTL, so subsequent commands don't re-prompt.
|
||||
|
||||
## Chrome Extension Architecture
|
||||
|
||||
The Chrome MV3 extension loads `idfoto-wasm` directly — no native messaging bridge.
|
||||
The Chrome MV3 extension loads `relicario-wasm` directly — no native messaging bridge.
|
||||
|
||||
- **Service worker:** initializes the WASM module, holds the master_key in memory after unlock, handles vault operations
|
||||
- **Popup:** passphrase prompt, entry list/search, entry detail view
|
||||
@@ -343,16 +343,16 @@ Extension design details (popup UI, content script heuristics, autofill flow) ar
|
||||
|
||||
Not in V1 scope. Planned approach:
|
||||
|
||||
- `idfoto export-recovery` generates a small encrypted file containing only the `image_secret` (32 bytes + metadata), locked with the passphrase alone (separate Argon2id derivation)
|
||||
- `relicario export-recovery` generates a small encrypted file containing only the `image_secret` (32 bytes + metadata), locked with the passphrase alone (separate Argon2id derivation)
|
||||
- User stores this file offline (USB drive, printed QR, safe deposit box)
|
||||
- Recovery: `idfoto recover --file recovery.enc` + passphrase → recovers image_secret → can decrypt vault from git
|
||||
- Recovery: `relicario recover --file recovery.enc` + passphrase → recovers image_secret → can decrypt vault from git
|
||||
- This is a second backup path alongside the "dead drop" reference JPEG (which can live on social media, personal website, etc.)
|
||||
|
||||
## Post-V1 Ideas
|
||||
|
||||
- **Secure notes:** free-form encrypted text entries (no URL/username/password schema, just a title + body). Same encryption, same repo layout — just a different entry type field.
|
||||
- **Secure document storage:** encrypted file attachments up to 5-10 MB per entry. Stored as separate `.enc` blobs in an `attachments/` directory, referenced by entry ID. Git handles large binary blobs tolerably at this scale; git-lfs is an option if vaults grow beyond ~100 MB total.
|
||||
- **`idfoto unlock` daemon:** ssh-agent-style background process that holds master_key for a configurable TTL, so repeated CLI commands don't re-prompt for passphrase.
|
||||
- **`relicario unlock` daemon:** ssh-agent-style background process that holds master_key for a configurable TTL, so repeated CLI commands don't re-prompt for passphrase.
|
||||
- **Mobile clients (Android/iOS):** Rust core compiles to ARM. Thin native wrappers (Kotlin/Swift) deferred.
|
||||
- **Import from LastPass/Bitwarden/1Password**
|
||||
- **Firefox/Safari extensions**
|
||||
@@ -1,4 +1,4 @@
|
||||
# idfoto — Credential Capture Design
|
||||
# relicario — Credential Capture Design
|
||||
|
||||
Experimental feature that detects login form submissions and prompts the user to save or update credentials in the vault. Configurable prompt style (notification bar or toast). Off by default.
|
||||
|
||||
@@ -60,7 +60,7 @@ A fixed-position bar at the top of the page, injected into the DOM:
|
||||
|
||||
```
|
||||
┌──────────────────────────────────────────────────────────────────┐
|
||||
│ idfoto: Save login for github.com? (alee) [Save] [Never] [✕] │
|
||||
│ relicario: Save login for github.com? (alee) [Save] [Never] [✕] │
|
||||
└──────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
@@ -77,7 +77,7 @@ A floating element in the bottom-right corner:
|
||||
|
||||
```
|
||||
┌─────────────────────────────────┐
|
||||
│ idfoto │
|
||||
│ relicario │
|
||||
│ Save login for github.com? │
|
||||
│ alee │
|
||||
│ [Save] [Never] [✕] │
|
||||
@@ -103,7 +103,7 @@ When user clicks:
|
||||
Stored in `chrome.storage.local` under key `settings`:
|
||||
|
||||
```typescript
|
||||
interface IdfotoSettings {
|
||||
interface RelicarioSettings {
|
||||
captureEnabled: boolean; // default: false
|
||||
captureStyle: 'bar' | 'toast'; // default: 'bar'
|
||||
}
|
||||
@@ -138,7 +138,7 @@ The toggle and style selector write to `chrome.storage.local`. Blacklist entries
|
||||
| { type: 'check_credential'; url: string; username: string; password: string }
|
||||
| { type: 'blacklist_site'; hostname: string }
|
||||
| { type: 'get_settings' }
|
||||
| { type: 'update_settings'; settings: Partial<IdfotoSettings> }
|
||||
| { type: 'update_settings'; settings: Partial<RelicarioSettings> }
|
||||
| { type: 'get_blacklist' }
|
||||
| { type: 'remove_blacklist'; hostname: string }
|
||||
|
||||
@@ -161,7 +161,7 @@ extension/src/popup/components/settings.ts # Settings view
|
||||
extension/src/content/detector.ts # Import and init capture module
|
||||
extension/src/service-worker/index.ts # Handle new message types
|
||||
extension/src/shared/messages.ts # Add new Request/Response types
|
||||
extension/src/shared/types.ts # Add IdfotoSettings interface
|
||||
extension/src/shared/types.ts # Add RelicarioSettings interface
|
||||
extension/src/popup/popup.ts # Add 'settings' view to state machine
|
||||
extension/src/popup/components/unlock.ts # Wire up settings button
|
||||
```
|
||||
@@ -1,4 +1,4 @@
|
||||
# idfoto — Firefox Extension Port Design
|
||||
# relicario — Firefox Extension Port Design
|
||||
|
||||
Port the existing Chrome MV3 extension to Firefox. Shared TypeScript source, separate manifests, separate build outputs. No code changes to components, popup, or content script.
|
||||
|
||||
@@ -40,12 +40,12 @@ Firefox supports the `chrome.*` namespace for WebExtension APIs, so no `browser.
|
||||
```json
|
||||
{
|
||||
"manifest_version": 3,
|
||||
"name": "idfoto",
|
||||
"name": "relicario",
|
||||
"version": "0.1.0",
|
||||
"description": "Two-factor encrypted password manager",
|
||||
"browser_specific_settings": {
|
||||
"gecko": {
|
||||
"id": "idfoto@adlee.work",
|
||||
"id": "relicario@adlee.work",
|
||||
"strict_min_version": "128.0"
|
||||
}
|
||||
},
|
||||
@@ -71,7 +71,7 @@ Firefox supports the `chrome.*` namespace for WebExtension APIs, so no `browser.
|
||||
"extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
|
||||
},
|
||||
"web_accessible_resources": [{
|
||||
"resources": ["setup.html", "setup.js", "styles.css", "idfoto_wasm_bg.wasm", "idfoto_wasm.js"]
|
||||
"resources": ["setup.html", "setup.js", "styles.css", "relicario_wasm_bg.wasm", "relicario_wasm.js"]
|
||||
}]
|
||||
}
|
||||
```
|
||||
@@ -94,12 +94,12 @@ async function initWasm(): Promise<WasmModule> {
|
||||
|
||||
if (typeof ServiceWorkerGlobalScope !== 'undefined') {
|
||||
// Chrome MV3: service worker context — use initSync
|
||||
const wasmResponse = await fetch(chrome.runtime.getURL('idfoto_wasm_bg.wasm'));
|
||||
const wasmResponse = await fetch(chrome.runtime.getURL('relicario_wasm_bg.wasm'));
|
||||
const wasmBytes = await wasmResponse.arrayBuffer();
|
||||
initSync({ module: new WebAssembly.Module(wasmBytes) });
|
||||
} else {
|
||||
// Firefox: background script context — dynamic import works
|
||||
const wasmUrl = chrome.runtime.getURL('idfoto_wasm_bg.wasm');
|
||||
const wasmUrl = chrome.runtime.getURL('relicario_wasm_bg.wasm');
|
||||
await initDefault(wasmUrl);
|
||||
}
|
||||
|
||||
@@ -130,7 +130,7 @@ Identical to `webpack.config.js` except:
|
||||
"build:all": "npm run build:wasm && npm run build && npm run build:firefox",
|
||||
"dev": "webpack --mode development --watch",
|
||||
"dev:firefox": "webpack --config webpack.firefox.config.js --mode development --watch",
|
||||
"build:wasm": "wasm-pack build ../crates/idfoto-wasm --target web --out-dir ../../extension/wasm"
|
||||
"build:wasm": "wasm-pack build ../crates/relicario-wasm --target web --out-dir ../../extension/wasm"
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -1,6 +1,6 @@
|
||||
# idfoto — Standalone Vault Initialization Wizard Design
|
||||
# relicario — Standalone Vault Initialization Wizard Design
|
||||
|
||||
A browser-based wizard that guides new users through creating an idfoto vault from scratch. Lives at `extension/setup.html`, uses the same WASM module as the extension, same terminal dark aesthetic. No server, no Rust toolchain required.
|
||||
A browser-based wizard that guides new users through creating an relicario vault from scratch. Lives at `extension/setup.html`, uses the same WASM module as the extension, same terminal dark aesthetic. No server, no Rust toolchain required.
|
||||
|
||||
## Scope
|
||||
|
||||
@@ -37,7 +37,7 @@ Step includes a "Next" button. No validation needed at this step.
|
||||
|
||||
Fields:
|
||||
- Host URL (e.g. `https://git.adlee.work` or `https://github.com`) — pre-filled based on host type selection
|
||||
- Repository path (e.g. `alee/idfoto-vault`)
|
||||
- Repository path (e.g. `alee/relicario-vault`)
|
||||
- API token (password field)
|
||||
|
||||
"Test Connection" button:
|
||||
@@ -58,15 +58,15 @@ Two inputs:
|
||||
|
||||
1. Load WASM module
|
||||
2. Generate random 32-byte `image_secret` via `crypto.getRandomValues()`
|
||||
3. Embed secret into carrier JPEG via WASM `extract_image_secret` — wait, that's extract. We need `embed`. Check: the WASM crate currently only exposes `extract_image_secret`, not `embed`. **We need to add a `embed_image_secret` function to `idfoto-wasm`.**
|
||||
3. Embed secret into carrier JPEG via WASM `extract_image_secret` — wait, that's extract. We need `embed`. Check: the WASM crate currently only exposes `extract_image_secret`, not `embed`. **We need to add a `embed_image_secret` function to `relicario-wasm`.**
|
||||
4. Generate random 32-byte `salt` via `crypto.getRandomValues()`
|
||||
5. Create `params.json` with default KDF params (`{"argon2_m":65536,"argon2_t":3,"argon2_p":4}`)
|
||||
6. Derive `master_key` via WASM `derive_master_key(passphrase, image_secret, salt, params_json)`
|
||||
7. Encrypt empty manifest (`{"entries":{},"version":1}`) via WASM `encrypt_manifest`
|
||||
8. Push files to repo via git API:
|
||||
- `.idfoto/salt` (raw 32 bytes)
|
||||
- `.idfoto/params.json` (JSON string)
|
||||
- `.idfoto/devices.json` (`[]`)
|
||||
- `.relicario/salt` (raw 32 bytes)
|
||||
- `.relicario/params.json` (JSON string)
|
||||
- `.relicario/devices.json` (`[]`)
|
||||
- `manifest.enc` (encrypted manifest bytes)
|
||||
9. Show progress bar during push operations
|
||||
|
||||
@@ -81,20 +81,20 @@ Two things happen:
|
||||
- Show warning: "Keep this image safe. You need it alongside your passphrase to unlock the vault. Store it somewhere you won't lose it."
|
||||
|
||||
**Push config to extension (if available):**
|
||||
- Try to detect the idfoto extension via `chrome.runtime.sendMessage` with a `get_setup_state` message
|
||||
- Try to detect the relicario extension via `chrome.runtime.sendMessage` with a `get_setup_state` message
|
||||
- If extension responds: push `save_setup` message with `{ config: { hostType, hostUrl, repoPath, apiToken }, imageBase64 }`. Show "Extension configured! You can now open the extension and unlock your vault."
|
||||
- If extension not detected: show the config as a copyable JSON blob with instructions: "Install the idfoto extension, then paste this into the setup wizard." (Or just tell them to run through the extension setup manually with the same host/token/repo.)
|
||||
- If extension not detected: show the config as a copyable JSON blob with instructions: "Install the relicario extension, then paste this into the setup wizard." (Or just tell them to run through the extension setup manually with the same host/token/repo.)
|
||||
|
||||
## WASM Crate Change
|
||||
|
||||
The `idfoto-wasm` crate needs one new function:
|
||||
The `relicario-wasm` crate needs one new function:
|
||||
|
||||
```rust
|
||||
#[wasm_bindgen]
|
||||
pub fn embed_image_secret(carrier_jpeg: &[u8], secret: &[u8]) -> Result<Vec<u8>, JsValue>
|
||||
```
|
||||
|
||||
This wraps `idfoto_core::imgsecret::embed`. Currently only `extract_image_secret` is exposed.
|
||||
This wraps `relicario_core::imgsecret::embed`. Currently only `extract_image_secret` is exposed.
|
||||
|
||||
## File Structure
|
||||
|
||||
@@ -154,7 +154,7 @@ Add `setup.html` to the extension so it can be opened as a chrome-extension page
|
||||
```json
|
||||
{
|
||||
"web_accessible_resources": [{
|
||||
"resources": ["setup.html", "setup.js", "styles.css", "idfoto_wasm_bg.wasm", "idfoto_wasm.js"],
|
||||
"resources": ["setup.html", "setup.js", "styles.css", "relicario_wasm_bg.wasm", "relicario_wasm.js"],
|
||||
"matches": ["<all_urls>"]
|
||||
}]
|
||||
}
|
||||
@@ -1,10 +1,10 @@
|
||||
# idfoto — WASM + Chrome MV3 Extension Design
|
||||
# relicario — WASM + Chrome MV3 Extension Design
|
||||
|
||||
The browser extension for idfoto. Compiles `idfoto-core` to WASM, wraps it in a Chrome MV3 extension with a terminal-aesthetic popup, conservative autofill, and direct Gitea/GitHub API access. No CLI dependency, no native messaging bridge.
|
||||
The browser extension for relicario. Compiles `relicario-core` to WASM, wraps it in a Chrome MV3 extension with a terminal-aesthetic popup, conservative autofill, and direct Gitea/GitHub API access. No CLI dependency, no native messaging bridge.
|
||||
|
||||
## Scope
|
||||
|
||||
- `idfoto-wasm` crate — wasm-bindgen wrapper around `idfoto-core`
|
||||
- `relicario-wasm` crate — wasm-bindgen wrapper around `relicario-core`
|
||||
- Chrome MV3 extension:
|
||||
- One-time setup wizard (git host + token + repo + reference image)
|
||||
- Service worker — WASM runtime, master_key holder, vault operations, git API
|
||||
@@ -44,9 +44,9 @@ pub struct ManifestEntry {
|
||||
|
||||
The `group` field is a free-form string. No predefined list, no nesting. User types "work" or "family" and entries cluster. Backwards-compatible — existing vaults without `group` deserialize as `None` (ungrouped).
|
||||
|
||||
## WASM Crate (`idfoto-wasm`)
|
||||
## WASM Crate (`relicario-wasm`)
|
||||
|
||||
Thin wasm-bindgen wrapper exposing `idfoto-core` functions to JavaScript. Lives at `crates/idfoto-wasm/`.
|
||||
Thin wasm-bindgen wrapper exposing `relicario-core` functions to JavaScript. Lives at `crates/relicario-wasm/`.
|
||||
|
||||
### Public API
|
||||
|
||||
@@ -94,7 +94,7 @@ pub fn generate_entry_id() -> String
|
||||
|
||||
```toml
|
||||
[dependencies]
|
||||
idfoto-core = { path = "../idfoto-core" }
|
||||
relicario-core = { path = "../relicario-core" }
|
||||
wasm-bindgen = "0.2"
|
||||
js-sys = "0.3"
|
||||
serde_json = "1"
|
||||
@@ -106,10 +106,10 @@ data-encoding = "2" # base32 decoding for TOTP secrets
|
||||
### WASM build
|
||||
|
||||
```bash
|
||||
wasm-pack build crates/idfoto-wasm --target web --out-dir ../../extension/wasm
|
||||
wasm-pack build crates/relicario-wasm --target web --out-dir ../../extension/wasm
|
||||
```
|
||||
|
||||
Output: `idfoto_wasm.js` (JS glue) + `idfoto_wasm_bg.wasm` (binary). Expected size ~200-500 KB gzipped. The `image` crate's JPEG decoder is the heaviest component — optimize only if measured size is a problem.
|
||||
Output: `relicario_wasm.js` (JS glue) + `relicario_wasm_bg.wasm` (binary). Expected size ~200-500 KB gzipped. The `image` crate's JPEG decoder is the heaviest component — optimize only if measured size is a problem.
|
||||
|
||||
### TOTP implementation
|
||||
|
||||
@@ -147,7 +147,7 @@ interface WorkerState {
|
||||
interface VaultConfig {
|
||||
hostType: "gitea" | "github";
|
||||
hostUrl: string; // e.g. "https://git.adlee.work"
|
||||
repoPath: string; // e.g. "alee/idfoto-vault"
|
||||
repoPath: string; // e.g. "alee/relicario-vault"
|
||||
apiToken: string; // personal access token
|
||||
imageBytes: Uint8Array; // reference JPEG, stored in chrome.storage.local
|
||||
}
|
||||
@@ -190,7 +190,7 @@ Popup and content script communicate with the service worker via typed messages:
|
||||
2. Popup sends `{ type: "unlock", passphrase }` to service worker
|
||||
3. Service worker loads vault config from `chrome.storage.local` (includes image bytes)
|
||||
4. WASM: `extract_image_secret(image_bytes)` → `image_secret`
|
||||
5. Service worker fetches `.idfoto/salt` and `.idfoto/params.json` via git API
|
||||
5. Service worker fetches `.relicario/salt` and `.relicario/params.json` via git API
|
||||
6. WASM: `derive_master_key(passphrase, image_secret, salt, params)` → `master_key`
|
||||
7. Service worker fetches `manifest.enc` via git API
|
||||
8. WASM: `decrypt_manifest(manifest_enc, master_key)` → manifest
|
||||
@@ -330,7 +330,7 @@ No shadow DOM traversal. No heuristic scoring. No iframe inspection. If the form
|
||||
### 2. Field Icon Injection
|
||||
|
||||
When a password field is detected:
|
||||
- Small idfoto icon (16x16, inline SVG) appears at the right edge of the password field
|
||||
- Small relicario icon (16x16, inline SVG) appears at the right edge of the password field
|
||||
- Click triggers: send page URL to service worker → get matching entries
|
||||
- Single match: fill immediately
|
||||
- Multiple matches: show inline picker (small dropdown below the icon)
|
||||
@@ -380,7 +380,7 @@ extension/
|
||||
│ └── shared/
|
||||
│ ├── messages.ts # typed message definitions
|
||||
│ └── types.ts # Entry, ManifestEntry, VaultConfig, etc.
|
||||
├── wasm/ # wasm-pack output (idfoto_wasm.js + .wasm)
|
||||
├── wasm/ # wasm-pack output (relicario_wasm.js + .wasm)
|
||||
├── icons/ # extension icons (16, 48, 128px)
|
||||
└── dist/ # build output → load unpacked into Chrome
|
||||
```
|
||||
@@ -392,7 +392,7 @@ No framework. Vanilla TypeScript + DOM manipulation. The popup is small enough t
|
||||
### WASM build
|
||||
|
||||
```bash
|
||||
wasm-pack build crates/idfoto-wasm --target web --out-dir ../../extension/wasm
|
||||
wasm-pack build crates/relicario-wasm --target web --out-dir ../../extension/wasm
|
||||
```
|
||||
|
||||
### Extension build
|
||||
@@ -414,7 +414,7 @@ Chains wasm-pack then webpack. Dev mode: `npm run dev` watches TypeScript and au
|
||||
```json
|
||||
{
|
||||
"manifest_version": 3,
|
||||
"name": "idfoto",
|
||||
"name": "relicario",
|
||||
"version": "0.1.0",
|
||||
"description": "Two-factor encrypted password manager",
|
||||
"permissions": ["storage", "activeTab", "clipboardWrite"],
|
||||
@@ -476,7 +476,7 @@ The token is stored in `chrome.storage.local`, which is sandboxed per-extension
|
||||
|
||||
- Unit tests: each wrapper function round-trips correctly (`wasm-pack test --node`)
|
||||
- TOTP: test vectors from RFC 6238 appendix B
|
||||
- Integration: derive key + encrypt + decrypt cycle matches `idfoto-core` output
|
||||
- Integration: derive key + encrypt + decrypt cycle matches `relicario-core` output
|
||||
|
||||
### Extension (manual for V1)
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# idfoto — Typed Item Data Model Design
|
||||
# relicario — Typed Item Data Model Design
|
||||
|
||||
Foundational data-model rewrite for idfoto. Replaces the single `Entry` type with a polymorphic typed-item system supporting Login, SecureNote, Identity, Card, Key, Document, and TOTP — with sections, custom fields, attachments, password history, soft-delete, and the security architecture needed to support 1Password-style daily-driver UX.
|
||||
Foundational data-model rewrite for relicario. Replaces the single `Entry` type with a polymorphic typed-item system supporting Login, SecureNote, Identity, Card, Key, Document, and TOTP — with sections, custom fields, attachments, password history, soft-delete, and the security architecture needed to support 1Password-style daily-driver UX.
|
||||
|
||||
This is **Phase 1** of the broader 1Password-parity roadmap. Phase 0 (audit remediation) is the precursor implementation pass; Phase 2+ (admin portal, importers, Watchtower checks, etc.) build on top of this model.
|
||||
|
||||
@@ -8,7 +8,7 @@ This is **Phase 1** of the broader 1Password-parity roadmap. Phase 0 (audit reme
|
||||
|
||||
In:
|
||||
|
||||
- New typed-item Rust data model in `idfoto-core` (replaces `Entry`)
|
||||
- New typed-item Rust data model in `relicario-core` (replaces `Entry`)
|
||||
- New on-disk repo layout (items + attachments split, settings file, format version 2)
|
||||
- Cryptographic envelope updates (length-prefixed Argon2 inputs, Zeroize discipline, opaque session-handle WASM bridge)
|
||||
- Security architecture for the extension boundary (split message router, origin-checked autofill, closed Shadow DOM rendering, hardened CLI git shell-out)
|
||||
@@ -69,7 +69,7 @@ Captured during brainstorming so the rationale is preserved:
|
||||
|
||||
```
|
||||
┌────────────────────────────────────────────────────────────────────┐
|
||||
│ idfoto-core (Rust) │
|
||||
│ relicario-core (Rust) │
|
||||
│ - Item, ItemCore (7 variants), Field, Section, Attachment │
|
||||
│ - Manifest, VaultSettings │
|
||||
│ - crypto: KDF (length-prefixed), AEAD, Zeroize discipline │
|
||||
@@ -79,7 +79,7 @@ Captured during brainstorming so the rationale is preserved:
|
||||
│ │
|
||||
▼ ▼
|
||||
┌──────────────────────┐ ┌──────────────────────────────────┐
|
||||
│ idfoto-cli (Rust) │ │ idfoto-wasm (Rust → WASM) │
|
||||
│ relicario-cli (Rust) │ │ relicario-wasm (Rust → WASM) │
|
||||
│ - clap commands │ │ - opaque session handles │
|
||||
│ - hardened git │ │ - typed-item API surface │
|
||||
│ - rpassword 7.x │ │ - master_key never returned to │
|
||||
@@ -141,7 +141,7 @@ pub enum ItemCore {
|
||||
}
|
||||
```
|
||||
|
||||
Each variant struct lives in `crates/idfoto-core/src/item_types/<type>.rs`. Compiler enforces exhaustiveness across the codebase — adding a new variant later means: create the file, add the enum variant, fix the (typically ~5) match-arm sites the compiler points at, register the UI form. No reflection, no registry, no runtime dispatch.
|
||||
Each variant struct lives in `crates/relicario-core/src/item_types/<type>.rs`. Compiler enforces exhaustiveness across the codebase — adding a new variant later means: create the file, add the enum variant, fix the (typically ~5) match-arm sites the compiler points at, register the UI form. No reflection, no registry, no runtime dispatch.
|
||||
|
||||
### Per-type cores
|
||||
|
||||
@@ -296,14 +296,14 @@ pub enum SymbolCharset {
|
||||
}
|
||||
```
|
||||
|
||||
Single canonical generator implementation in `idfoto-core`, exposed via WASM and used by CLI directly. Both paths use `getrandom`-backed `OsRng` and `rand::distributions::Uniform` for unbiased sampling.
|
||||
Single canonical generator implementation in `relicario-core`, exposed via WASM and used by CLI directly. Both paths use `getrandom`-backed `OsRng` and `rand::distributions::Uniform` for unbiased sampling.
|
||||
|
||||
## Storage, Manifest & Sync
|
||||
|
||||
### Repo layout
|
||||
|
||||
```
|
||||
.idfoto/
|
||||
.relicario/
|
||||
salt # 32-byte vault salt (KDF input)
|
||||
params.json # Argon2id parameters, format version
|
||||
devices.json # authorized device ed25519 pubkeys
|
||||
@@ -405,7 +405,7 @@ pub fn derive_master_key(
|
||||
image_secret: &[u8; 32],
|
||||
salt: &[u8; 32],
|
||||
params: &Argon2Params,
|
||||
) -> Result<Zeroizing<[u8; 32]>, IdfotoError> {
|
||||
) -> Result<Zeroizing<[u8; 32]>, RelicarioError> {
|
||||
let passphrase_nfc = passphrase.nfc().collect::<String>(); // normalize once
|
||||
|
||||
let mut password = Zeroizing::new(
|
||||
@@ -461,13 +461,13 @@ Per-encryption layout (item, manifest, settings, each attachment):
|
||||
- `VERSION_BYTE = 0x02` (clean break — no v1 compat).
|
||||
- XChaCha20-Poly1305 (already correct, audit confirmed-safe #1).
|
||||
- Fresh `OsRng`-derived nonce per encryption.
|
||||
- Decrypt failure returns opaque `IdfotoError::Decrypt` regardless of which validation tripped (audit M4).
|
||||
- Decrypt failure returns opaque `RelicarioError::Decrypt` regardless of which validation tripped (audit M4).
|
||||
|
||||
### RNG (audit H5, H6)
|
||||
|
||||
- `idfoto-wasm` uses `getrandom` (with `js` feature) for password generation, item IDs, attachment IDs. **No `Math.random()` anywhere.**
|
||||
- `relicario-wasm` uses `getrandom` (with `js` feature) for password generation, item IDs, attachment IDs. **No `Math.random()` anywhere.**
|
||||
- Modulo-bias eliminated via `rand::distributions::Uniform` for charset sampling — both CLI and WASM paths.
|
||||
- Single canonical `generate_password` and `generate_bip39` in `idfoto-core`, exposed to WASM and called directly by CLI.
|
||||
- Single canonical `generate_password` and `generate_bip39` in `relicario-core`, exposed to WASM and called directly by CLI.
|
||||
|
||||
### ID format (audit M8)
|
||||
|
||||
@@ -476,14 +476,14 @@ Per-encryption layout (item, manifest, settings, each attachment):
|
||||
|
||||
### Per-vault crypto metadata
|
||||
|
||||
`.idfoto/params.json`:
|
||||
`.relicario/params.json`:
|
||||
|
||||
```json
|
||||
{
|
||||
"format_version": 2,
|
||||
"kdf": { "algorithm": "argon2id-v0x13", "m": 65536, "t": 3, "p": 4 },
|
||||
"aead": "xchacha20poly1305",
|
||||
"salt_path": ".idfoto/salt"
|
||||
"salt_path": ".relicario/salt"
|
||||
}
|
||||
```
|
||||
|
||||
@@ -493,7 +493,7 @@ Three version fields exist intentionally and evolve independently:
|
||||
|
||||
| Field | Where | Bumps when |
|
||||
|---|---|---|
|
||||
| `format_version` | `.idfoto/params.json` | Overall vault layout changes (file structure, KDF construction, anything cross-cutting) |
|
||||
| `format_version` | `.relicario/params.json` | Overall vault layout changes (file structure, KDF construction, anything cross-cutting) |
|
||||
| `schema_version` | inside `manifest.enc` | Manifest entry shape changes only (e.g., adding a new field to `ManifestEntry`) |
|
||||
| `VERSION_BYTE` | first byte of every AEAD blob | AEAD construction itself changes (cipher, nonce size, tag layout) |
|
||||
|
||||
@@ -505,7 +505,7 @@ All three set to `2` for the initial typed-item release. Future bumps are indepe
|
||||
|
||||
- `setup.html` and `setup.js` **removed from `web_accessible_resources`** in both `extension/manifest.json` and `extension/manifest.firefox.json`.
|
||||
- The popup opens setup via `chrome.tabs.create({ url: chrome.runtime.getURL('setup.html') })` — own-origin extension tabs work without WAR.
|
||||
- WASM artifacts (`idfoto_wasm.js`, `idfoto_wasm_bg.wasm`) removed from WAR — service worker loads them via `import` from extension origin.
|
||||
- WASM artifacts (`relicario_wasm.js`, `relicario_wasm_bg.wasm`) removed from WAR — service worker loads them via `import` from extension origin.
|
||||
|
||||
### Split message router (audit C1, C2, C4)
|
||||
|
||||
@@ -593,7 +593,7 @@ root.appendChild(promptDom);
|
||||
Strict rules for content-script DOM construction:
|
||||
|
||||
1. **No `innerHTML` anywhere in content scripts.** All construction via `document.createElement` + `.textContent =`.
|
||||
2. **Element IDs randomized per-prompt** (no stable `idfoto-save-btn` for page collisions). Use a per-prompt `Map<string, HTMLElement>` to wire up handlers.
|
||||
2. **Element IDs randomized per-prompt** (no stable `relicario-save-btn` for page collisions). Use a per-prompt `Map<string, HTMLElement>` to wire up handlers.
|
||||
3. **Page-derived values bounded** — username field from `findUsernameValue` capped at 256 chars, control characters stripped, then assigned only via `.textContent`.
|
||||
4. **CSS scoped via Shadow DOM** — no leak to/from page CSS.
|
||||
|
||||
@@ -657,7 +657,7 @@ These audit items are bundled into the Phase 0 remediation plan (not this Phase
|
||||
- M7: CLI stdout `Password: ********` by default + `--show` flag.
|
||||
- M11: CLI ISO-8601 timestamp formatting.
|
||||
- L7: `cargo audit` / `cargo deny` CI configuration.
|
||||
- L8: CLI vault-dir detection (refuse to operate outside an `.idfoto/`-marked directory).
|
||||
- L8: CLI vault-dir detection (refuse to operate outside an `.relicario/`-marked directory).
|
||||
|
||||
## WASM API Surface
|
||||
|
||||
@@ -720,38 +720,38 @@ New commands and renamed semantics:
|
||||
|
||||
```bash
|
||||
# Existing (semantics carry forward, terminology updated to "item")
|
||||
idfoto init
|
||||
idfoto unlock # unlocks for next command
|
||||
idfoto lock
|
||||
idfoto sync # git pull --rebase + push, hardened
|
||||
idfoto generate [--length N] [--bip39 [--words N]] [--symbols safe|extended]
|
||||
idfoto device <add|list|revoke>
|
||||
relicario init
|
||||
relicario unlock # unlocks for next command
|
||||
relicario lock
|
||||
relicario sync # git pull --rebase + push, hardened
|
||||
relicario generate [--length N] [--bip39 [--words N]] [--symbols safe|extended]
|
||||
relicario device <add|list|revoke>
|
||||
|
||||
# Updated for typed items
|
||||
idfoto add <type> [--title T] [--group G] [--tags t1,t2] [--favorite]
|
||||
relicario add <type> [--title T] [--group G] [--tags t1,t2] [--favorite]
|
||||
[...type-specific fields, e.g., --username, --url, --password-prompt]
|
||||
idfoto get <id-or-title> # always concealed by default; --show to reveal
|
||||
idfoto list [--type T] [--group G] [--tag T] [--trashed]
|
||||
idfoto edit <id-or-title> # interactive prompts for fields to update
|
||||
relicario get <id-or-title> # always concealed by default; --show to reveal
|
||||
relicario list [--type T] [--group G] [--tag T] [--trashed]
|
||||
relicario edit <id-or-title> # interactive prompts for fields to update
|
||||
# (no $EDITOR with plaintext — temp-file leak risk)
|
||||
idfoto rm <id-or-title> # soft-delete (trash)
|
||||
idfoto restore <id-or-title> # restore from trash
|
||||
idfoto purge <id-or-title> # hard-delete (also purges attachments)
|
||||
idfoto trash empty # hard-delete all past retention
|
||||
relicario rm <id-or-title> # soft-delete (trash)
|
||||
relicario restore <id-or-title> # restore from trash
|
||||
relicario purge <id-or-title> # hard-delete (also purges attachments)
|
||||
relicario trash empty # hard-delete all past retention
|
||||
|
||||
# New for attachments
|
||||
idfoto attach <id-or-title> <file> # adds file as attachment
|
||||
idfoto attachments <id-or-title> # list attachments on item
|
||||
idfoto extract <id-or-title> <aid> [--out path] # decrypt + save to disk
|
||||
relicario attach <id-or-title> <file> # adds file as attachment
|
||||
relicario attachments <id-or-title> # list attachments on item
|
||||
relicario extract <id-or-title> <aid> [--out path] # decrypt + save to disk
|
||||
|
||||
# Settings
|
||||
idfoto settings get [<key>]
|
||||
idfoto settings set <key> <value> # e.g., trash_retention=days:60
|
||||
relicario settings get [<key>]
|
||||
relicario settings set <key> <value> # e.g., trash_retention=days:60
|
||||
```
|
||||
|
||||
`idfoto get` shows password as `********` by default. `--show` is required to print plaintext. Clipboard auto-clear unconditional after 30s with `Zeroizing<String>` wrap (audit M6, M7).
|
||||
`relicario get` shows password as `********` by default. `--show` is required to print plaintext. Clipboard auto-clear unconditional after 30s with `Zeroizing<String>` wrap (audit M6, M7).
|
||||
|
||||
`vault_dir()` detection: traverses up from CWD looking for `.idfoto/`. Refuses to operate without one (audit L8).
|
||||
`vault_dir()` detection: traverses up from CWD looking for `.relicario/`. Refuses to operate without one (audit L8).
|
||||
|
||||
## Browser Extension UI Implications
|
||||
|
||||
@@ -792,7 +792,7 @@ Setup wizard, capture flow, autofill icon, and unlock screen all continue to exi
|
||||
|
||||
- **Service worker router**: mock `chrome.runtime.onMessage` and verify each message type is rejected when sent from the wrong sender (popup-only from content, content-callable from popup, anything from external).
|
||||
- **Origin-bound autofill**: mock `sender.tab.url` and verify cross-origin requests are rejected even when the content script asks nicely.
|
||||
- **Closed Shadow DOM**: render the capture prompt, verify the page-side `document.querySelector('#idfoto-save-btn')` returns null.
|
||||
- **Closed Shadow DOM**: render the capture prompt, verify the page-side `document.querySelector('#relicario-save-btn')` returns null.
|
||||
- **Generator**: verify no `Math.random()` reachable from any extension entry point (lint rule + runtime probe).
|
||||
|
||||
### Manual / observational
|
||||
@@ -826,7 +826,7 @@ Setup wizard, capture flow, autofill icon, and unlock screen all continue to exi
|
||||
| H6 | High | `rand::distributions::Uniform` in CLI generator |
|
||||
| H7 | High | Bump `rpassword` to 7.x (Phase 0) |
|
||||
| H8 | High | Documented in setup wizard + README; fine-grained PAT guidance |
|
||||
| M4 | Medium | Opaque `IdfotoError::Decrypt` for all decrypt failures |
|
||||
| M4 | Medium | Opaque `RelicarioError::Decrypt` for all decrypt failures |
|
||||
| M5 | Medium | Popup captures `(tab.id, tab.url)` at open; verifies on `fill_credentials` |
|
||||
| M8 | Medium | 16-char hex IDs |
|
||||
| M9 | Medium | Item type discriminant validation in deserializer |
|
||||
@@ -839,20 +839,20 @@ Phase 0 implementation handles the remaining items (M3, M6, M7, M11, L7, L8) out
|
||||
New files (Rust):
|
||||
|
||||
```
|
||||
crates/idfoto-core/src/item.rs # Item, Section, Field, FieldKind, FieldValue
|
||||
crates/idfoto-core/src/item_types/mod.rs
|
||||
crates/idfoto-core/src/item_types/login.rs
|
||||
crates/idfoto-core/src/item_types/secure_note.rs
|
||||
crates/idfoto-core/src/item_types/identity.rs
|
||||
crates/idfoto-core/src/item_types/card.rs
|
||||
crates/idfoto-core/src/item_types/key.rs
|
||||
crates/idfoto-core/src/item_types/document.rs
|
||||
crates/idfoto-core/src/item_types/totp.rs
|
||||
crates/idfoto-core/src/manifest.rs # rewritten
|
||||
crates/idfoto-core/src/settings.rs
|
||||
crates/idfoto-core/src/generators.rs
|
||||
crates/idfoto-core/src/attachment.rs
|
||||
crates/idfoto-wasm/src/session.rs
|
||||
crates/relicario-core/src/item.rs # Item, Section, Field, FieldKind, FieldValue
|
||||
crates/relicario-core/src/item_types/mod.rs
|
||||
crates/relicario-core/src/item_types/login.rs
|
||||
crates/relicario-core/src/item_types/secure_note.rs
|
||||
crates/relicario-core/src/item_types/identity.rs
|
||||
crates/relicario-core/src/item_types/card.rs
|
||||
crates/relicario-core/src/item_types/key.rs
|
||||
crates/relicario-core/src/item_types/document.rs
|
||||
crates/relicario-core/src/item_types/totp.rs
|
||||
crates/relicario-core/src/manifest.rs # rewritten
|
||||
crates/relicario-core/src/settings.rs
|
||||
crates/relicario-core/src/generators.rs
|
||||
crates/relicario-core/src/attachment.rs
|
||||
crates/relicario-wasm/src/session.rs
|
||||
```
|
||||
|
||||
New files (extension):
|
||||
@@ -875,15 +875,15 @@ extension/src/popup/components/history.ts
|
||||
Heavily modified (Rust):
|
||||
|
||||
```
|
||||
crates/idfoto-core/src/lib.rs # re-exports + module declarations
|
||||
crates/idfoto-core/src/crypto.rs # length-prefix KDF, Zeroize, NFC
|
||||
crates/idfoto-core/src/entry.rs # DELETED — replaced by item.rs
|
||||
crates/idfoto-core/src/error.rs # opaque Decrypt variant only
|
||||
crates/idfoto-core/Cargo.toml # add zeroize, zxcvbn, bip39, unicode-normalization
|
||||
crates/idfoto-wasm/src/lib.rs # session-handle API, getrandom
|
||||
crates/idfoto-wasm/Cargo.toml # update deps
|
||||
crates/idfoto-cli/src/main.rs # rewritten command handlers
|
||||
crates/idfoto-cli/Cargo.toml # rpassword = "7", clipboard hardening
|
||||
crates/relicario-core/src/lib.rs # re-exports + module declarations
|
||||
crates/relicario-core/src/crypto.rs # length-prefix KDF, Zeroize, NFC
|
||||
crates/relicario-core/src/entry.rs # DELETED — replaced by item.rs
|
||||
crates/relicario-core/src/error.rs # opaque Decrypt variant only
|
||||
crates/relicario-core/Cargo.toml # add zeroize, zxcvbn, bip39, unicode-normalization
|
||||
crates/relicario-wasm/src/lib.rs # session-handle API, getrandom
|
||||
crates/relicario-wasm/Cargo.toml # update deps
|
||||
crates/relicario-cli/src/main.rs # rewritten command handlers
|
||||
crates/relicario-cli/Cargo.toml # rpassword = "7", clipboard hardening
|
||||
```
|
||||
|
||||
Heavily modified (extension):
|
||||
@@ -916,5 +916,5 @@ Documentation:
|
||||
```
|
||||
README.md # update for typed items, security warnings
|
||||
CLAUDE.md # reflect new module structure
|
||||
docs/superpowers/specs/2026-04-11-idfoto-design.md # amend KDF section per H1; note format v2
|
||||
docs/superpowers/specs/2026-04-11-relicario-design.md # amend KDF section per H1; note format v2
|
||||
```
|
||||
338
extension/bun.lock
Normal file
338
extension/bun.lock
Normal file
@@ -0,0 +1,338 @@
|
||||
{
|
||||
"lockfileVersion": 1,
|
||||
"configVersion": 1,
|
||||
"workspaces": {
|
||||
"": {
|
||||
"name": "idfoto-extension",
|
||||
"devDependencies": {
|
||||
"@types/chrome": "^0.1.40",
|
||||
"copy-webpack-plugin": "^12.0",
|
||||
"ts-loader": "^9.5",
|
||||
"typescript": "^5.4",
|
||||
"webpack": "^5.90",
|
||||
"webpack-cli": "^5.1",
|
||||
},
|
||||
},
|
||||
},
|
||||
"packages": {
|
||||
"@discoveryjs/json-ext": ["@discoveryjs/json-ext@0.5.7", "", {}, "sha512-dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw=="],
|
||||
|
||||
"@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],
|
||||
|
||||
"@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="],
|
||||
|
||||
"@jridgewell/source-map": ["@jridgewell/source-map@0.3.11", "", { "dependencies": { "@jridgewell/gen-mapping": "^0.3.5", "@jridgewell/trace-mapping": "^0.3.25" } }, "sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA=="],
|
||||
|
||||
"@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],
|
||||
|
||||
"@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
|
||||
|
||||
"@nodelib/fs.scandir": ["@nodelib/fs.scandir@2.1.5", "", { "dependencies": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" } }, "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g=="],
|
||||
|
||||
"@nodelib/fs.stat": ["@nodelib/fs.stat@2.0.5", "", {}, "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A=="],
|
||||
|
||||
"@nodelib/fs.walk": ["@nodelib/fs.walk@1.2.8", "", { "dependencies": { "@nodelib/fs.scandir": "2.1.5", "fastq": "^1.6.0" } }, "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg=="],
|
||||
|
||||
"@sindresorhus/merge-streams": ["@sindresorhus/merge-streams@2.3.0", "", {}, "sha512-LtoMMhxAlorcGhmFYI+LhPgbPZCkgP6ra1YL604EeF6U98pLlQ3iWIGMdWSC+vWmPBWBNgmDBAhnAobLROJmwg=="],
|
||||
|
||||
"@types/chrome": ["@types/chrome@0.1.40", "", { "dependencies": { "@types/filesystem": "*", "@types/har-format": "*" } }, "sha512-UnfyRAe8ORu9HSuTH0EqyOEUin3JrWW9Nl/gDXezNfTUrfIoxw+WRZgKOxGz0t5BnjbfXBnS2eCYfW2PxH1wcA=="],
|
||||
|
||||
"@types/eslint": ["@types/eslint@9.6.1", "", { "dependencies": { "@types/estree": "*", "@types/json-schema": "*" } }, "sha512-FXx2pKgId/WyYo2jXw63kk7/+TY7u7AziEJxJAnSFzHlqTAS3Ync6SvgYAN/k4/PQpnnVuzoMuVnByKK2qp0ag=="],
|
||||
|
||||
"@types/eslint-scope": ["@types/eslint-scope@3.7.7", "", { "dependencies": { "@types/eslint": "*", "@types/estree": "*" } }, "sha512-MzMFlSLBqNF2gcHWO0G1vP/YQyfvrxZ0bF+u7mzUdZ1/xK4A4sru+nraZz5i3iEIk1l1uyicaDVTB4QbbEkAYg=="],
|
||||
|
||||
"@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
|
||||
|
||||
"@types/filesystem": ["@types/filesystem@0.0.36", "", { "dependencies": { "@types/filewriter": "*" } }, "sha512-vPDXOZuannb9FZdxgHnqSwAG/jvdGM8Wq+6N4D/d80z+D4HWH+bItqsZaVRQykAn6WEVeEkLm2oQigyHtgb0RA=="],
|
||||
|
||||
"@types/filewriter": ["@types/filewriter@0.0.33", "", {}, "sha512-xFU8ZXTw4gd358lb2jw25nxY9QAgqn2+bKKjKOYfNCzN4DKCFetK7sPtrlpg66Ywe3vWY9FNxprZawAh9wfJ3g=="],
|
||||
|
||||
"@types/har-format": ["@types/har-format@1.2.16", "", {}, "sha512-fluxdy7ryD3MV6h8pTfTYpy/xQzCFC7m89nOH9y94cNqJ1mDIDPut7MnRHI3F6qRmh/cT2fUjG1MLdCNb4hE9A=="],
|
||||
|
||||
"@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
|
||||
|
||||
"@types/node": ["@types/node@25.6.0", "", { "dependencies": { "undici-types": "~7.19.0" } }, "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ=="],
|
||||
|
||||
"@webassemblyjs/ast": ["@webassemblyjs/ast@1.14.1", "", { "dependencies": { "@webassemblyjs/helper-numbers": "1.13.2", "@webassemblyjs/helper-wasm-bytecode": "1.13.2" } }, "sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ=="],
|
||||
|
||||
"@webassemblyjs/floating-point-hex-parser": ["@webassemblyjs/floating-point-hex-parser@1.13.2", "", {}, "sha512-6oXyTOzbKxGH4steLbLNOu71Oj+C8Lg34n6CqRvqfS2O71BxY6ByfMDRhBytzknj9yGUPVJ1qIKhRlAwO1AovA=="],
|
||||
|
||||
"@webassemblyjs/helper-api-error": ["@webassemblyjs/helper-api-error@1.13.2", "", {}, "sha512-U56GMYxy4ZQCbDZd6JuvvNV/WFildOjsaWD3Tzzvmw/mas3cXzRJPMjP83JqEsgSbyrmaGjBfDtV7KDXV9UzFQ=="],
|
||||
|
||||
"@webassemblyjs/helper-buffer": ["@webassemblyjs/helper-buffer@1.14.1", "", {}, "sha512-jyH7wtcHiKssDtFPRB+iQdxlDf96m0E39yb0k5uJVhFGleZFoNw1c4aeIcVUPPbXUVJ94wwnMOAqUHyzoEPVMA=="],
|
||||
|
||||
"@webassemblyjs/helper-numbers": ["@webassemblyjs/helper-numbers@1.13.2", "", { "dependencies": { "@webassemblyjs/floating-point-hex-parser": "1.13.2", "@webassemblyjs/helper-api-error": "1.13.2", "@xtuc/long": "4.2.2" } }, "sha512-FE8aCmS5Q6eQYcV3gI35O4J789wlQA+7JrqTTpJqn5emA4U2hvwJmvFRC0HODS+3Ye6WioDklgd6scJ3+PLnEA=="],
|
||||
|
||||
"@webassemblyjs/helper-wasm-bytecode": ["@webassemblyjs/helper-wasm-bytecode@1.13.2", "", {}, "sha512-3QbLKy93F0EAIXLh0ogEVR6rOubA9AoZ+WRYhNbFyuB70j3dRdwH9g+qXhLAO0kiYGlg3TxDV+I4rQTr/YNXkA=="],
|
||||
|
||||
"@webassemblyjs/helper-wasm-section": ["@webassemblyjs/helper-wasm-section@1.14.1", "", { "dependencies": { "@webassemblyjs/ast": "1.14.1", "@webassemblyjs/helper-buffer": "1.14.1", "@webassemblyjs/helper-wasm-bytecode": "1.13.2", "@webassemblyjs/wasm-gen": "1.14.1" } }, "sha512-ds5mXEqTJ6oxRoqjhWDU83OgzAYjwsCV8Lo/N+oRsNDmx/ZDpqalmrtgOMkHwxsG0iI//3BwWAErYRHtgn0dZw=="],
|
||||
|
||||
"@webassemblyjs/ieee754": ["@webassemblyjs/ieee754@1.13.2", "", { "dependencies": { "@xtuc/ieee754": "^1.2.0" } }, "sha512-4LtOzh58S/5lX4ITKxnAK2USuNEvpdVV9AlgGQb8rJDHaLeHciwG4zlGr0j/SNWlr7x3vO1lDEsuePvtcDNCkw=="],
|
||||
|
||||
"@webassemblyjs/leb128": ["@webassemblyjs/leb128@1.13.2", "", { "dependencies": { "@xtuc/long": "4.2.2" } }, "sha512-Lde1oNoIdzVzdkNEAWZ1dZ5orIbff80YPdHx20mrHwHrVNNTjNr8E3xz9BdpcGqRQbAEa+fkrCb+fRFTl/6sQw=="],
|
||||
|
||||
"@webassemblyjs/utf8": ["@webassemblyjs/utf8@1.13.2", "", {}, "sha512-3NQWGjKTASY1xV5m7Hr0iPeXD9+RDobLll3T9d2AO+g3my8xy5peVyjSag4I50mR1bBSN/Ct12lo+R9tJk0NZQ=="],
|
||||
|
||||
"@webassemblyjs/wasm-edit": ["@webassemblyjs/wasm-edit@1.14.1", "", { "dependencies": { "@webassemblyjs/ast": "1.14.1", "@webassemblyjs/helper-buffer": "1.14.1", "@webassemblyjs/helper-wasm-bytecode": "1.13.2", "@webassemblyjs/helper-wasm-section": "1.14.1", "@webassemblyjs/wasm-gen": "1.14.1", "@webassemblyjs/wasm-opt": "1.14.1", "@webassemblyjs/wasm-parser": "1.14.1", "@webassemblyjs/wast-printer": "1.14.1" } }, "sha512-RNJUIQH/J8iA/1NzlE4N7KtyZNHi3w7at7hDjvRNm5rcUXa00z1vRz3glZoULfJ5mpvYhLybmVcwcjGrC1pRrQ=="],
|
||||
|
||||
"@webassemblyjs/wasm-gen": ["@webassemblyjs/wasm-gen@1.14.1", "", { "dependencies": { "@webassemblyjs/ast": "1.14.1", "@webassemblyjs/helper-wasm-bytecode": "1.13.2", "@webassemblyjs/ieee754": "1.13.2", "@webassemblyjs/leb128": "1.13.2", "@webassemblyjs/utf8": "1.13.2" } }, "sha512-AmomSIjP8ZbfGQhumkNvgC33AY7qtMCXnN6bL2u2Js4gVCg8fp735aEiMSBbDR7UQIj90n4wKAFUSEd0QN2Ukg=="],
|
||||
|
||||
"@webassemblyjs/wasm-opt": ["@webassemblyjs/wasm-opt@1.14.1", "", { "dependencies": { "@webassemblyjs/ast": "1.14.1", "@webassemblyjs/helper-buffer": "1.14.1", "@webassemblyjs/wasm-gen": "1.14.1", "@webassemblyjs/wasm-parser": "1.14.1" } }, "sha512-PTcKLUNvBqnY2U6E5bdOQcSM+oVP/PmrDY9NzowJjislEjwP/C4an2303MCVS2Mg9d3AJpIGdUFIQQWbPds0Sw=="],
|
||||
|
||||
"@webassemblyjs/wasm-parser": ["@webassemblyjs/wasm-parser@1.14.1", "", { "dependencies": { "@webassemblyjs/ast": "1.14.1", "@webassemblyjs/helper-api-error": "1.13.2", "@webassemblyjs/helper-wasm-bytecode": "1.13.2", "@webassemblyjs/ieee754": "1.13.2", "@webassemblyjs/leb128": "1.13.2", "@webassemblyjs/utf8": "1.13.2" } }, "sha512-JLBl+KZ0R5qB7mCnud/yyX08jWFw5MsoalJ1pQ4EdFlgj9VdXKGuENGsiCIjegI1W7p91rUlcB/LB5yRJKNTcQ=="],
|
||||
|
||||
"@webassemblyjs/wast-printer": ["@webassemblyjs/wast-printer@1.14.1", "", { "dependencies": { "@webassemblyjs/ast": "1.14.1", "@xtuc/long": "4.2.2" } }, "sha512-kPSSXE6De1XOR820C90RIo2ogvZG+c3KiHzqUoO/F34Y2shGzesfqv7o57xrxovZJH/MetF5UjroJ/R/3isoiw=="],
|
||||
|
||||
"@webpack-cli/configtest": ["@webpack-cli/configtest@2.1.1", "", { "peerDependencies": { "webpack": "5.x.x", "webpack-cli": "5.x.x" } }, "sha512-wy0mglZpDSiSS0XHrVR+BAdId2+yxPSoJW8fsna3ZpYSlufjvxnP4YbKTCBZnNIcGN4r6ZPXV55X4mYExOfLmw=="],
|
||||
|
||||
"@webpack-cli/info": ["@webpack-cli/info@2.0.2", "", { "peerDependencies": { "webpack": "5.x.x", "webpack-cli": "5.x.x" } }, "sha512-zLHQdI/Qs1UyT5UBdWNqsARasIA+AaF8t+4u2aS2nEpBQh2mWIVb8qAklq0eUENnC5mOItrIB4LiS9xMtph18A=="],
|
||||
|
||||
"@webpack-cli/serve": ["@webpack-cli/serve@2.0.5", "", { "peerDependencies": { "webpack": "5.x.x", "webpack-cli": "5.x.x" } }, "sha512-lqaoKnRYBdo1UgDX8uF24AfGMifWK19TxPmM5FHc2vAGxrJ/qtyUyFBWoY1tISZdelsQ5fBcOusifo5o5wSJxQ=="],
|
||||
|
||||
"@xtuc/ieee754": ["@xtuc/ieee754@1.2.0", "", {}, "sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA=="],
|
||||
|
||||
"@xtuc/long": ["@xtuc/long@4.2.2", "", {}, "sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ=="],
|
||||
|
||||
"acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
|
||||
|
||||
"acorn-import-phases": ["acorn-import-phases@1.0.4", "", { "peerDependencies": { "acorn": "^8.14.0" } }, "sha512-wKmbr/DDiIXzEOiWrTTUcDm24kQ2vGfZQvM2fwg2vXqR5uW6aapr7ObPtj1th32b9u90/Pf4AItvdTh42fBmVQ=="],
|
||||
|
||||
"ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="],
|
||||
|
||||
"ajv-formats": ["ajv-formats@2.1.1", "", { "dependencies": { "ajv": "^8.0.0" } }, "sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA=="],
|
||||
|
||||
"ajv-keywords": ["ajv-keywords@5.1.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3" }, "peerDependencies": { "ajv": "^8.8.2" } }, "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw=="],
|
||||
|
||||
"ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
|
||||
|
||||
"baseline-browser-mapping": ["baseline-browser-mapping@2.10.18", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-VSnGQAOLtP5mib/DPyg2/t+Tlv65NTBz83BJBJvmLVHHuKJVaDOBvJJykiT5TR++em5nfAySPccDZDa4oSrn8A=="],
|
||||
|
||||
"braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
|
||||
|
||||
"browserslist": ["browserslist@4.28.2", "", { "dependencies": { "baseline-browser-mapping": "^2.10.12", "caniuse-lite": "^1.0.30001782", "electron-to-chromium": "^1.5.328", "node-releases": "^2.0.36", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg=="],
|
||||
|
||||
"buffer-from": ["buffer-from@1.1.2", "", {}, "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="],
|
||||
|
||||
"caniuse-lite": ["caniuse-lite@1.0.30001787", "", {}, "sha512-mNcrMN9KeI68u7muanUpEejSLghOKlVhRqS/Za2IeyGllJ9I9otGpR9g3nsw7n4W378TE/LyIteA0+/FOZm4Kg=="],
|
||||
|
||||
"chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
|
||||
|
||||
"chrome-trace-event": ["chrome-trace-event@1.0.4", "", {}, "sha512-rNjApaLzuwaOTjCiT8lSDdGN1APCiqkChLMJxJPWLunPAt5fy8xgU9/jNOchV84wfIxrA0lRQB7oCT8jrn/wrQ=="],
|
||||
|
||||
"clone-deep": ["clone-deep@4.0.1", "", { "dependencies": { "is-plain-object": "^2.0.4", "kind-of": "^6.0.2", "shallow-clone": "^3.0.0" } }, "sha512-neHB9xuzh/wk0dIHweyAXv2aPGZIVk3pLMe+/RNzINf17fe0OG96QroktYAUm7SM1PBnzTabaLboqqxDyMU+SQ=="],
|
||||
|
||||
"color-convert": ["color-convert@2.0.1", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="],
|
||||
|
||||
"color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
|
||||
|
||||
"colorette": ["colorette@2.0.20", "", {}, "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w=="],
|
||||
|
||||
"commander": ["commander@10.0.1", "", {}, "sha512-y4Mg2tXshplEbSGzx7amzPwKKOCGuoSRP/CjEdwwk0FOGlUbq6lKuoyDZTNZkmxHdJtp54hdfY/JUrdL7Xfdug=="],
|
||||
|
||||
"copy-webpack-plugin": ["copy-webpack-plugin@12.0.2", "", { "dependencies": { "fast-glob": "^3.3.2", "glob-parent": "^6.0.1", "globby": "^14.0.0", "normalize-path": "^3.0.0", "schema-utils": "^4.2.0", "serialize-javascript": "^6.0.2" }, "peerDependencies": { "webpack": "^5.1.0" } }, "sha512-SNwdBeHyII+rWvee/bTnAYyO8vfVdcSTud4EIb6jcZ8inLeWucJE0DnxXQBjlQ5zlteuuvooGQy3LIyGxhvlOA=="],
|
||||
|
||||
"cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
|
||||
|
||||
"electron-to-chromium": ["electron-to-chromium@1.5.335", "", {}, "sha512-q9n5T4BR4Xwa2cwbrwcsDJtHD/enpQ5S1xF1IAtdqf5AAgqDFmR/aakqH3ChFdqd/QXJhS3rnnXFtexU7rax6Q=="],
|
||||
|
||||
"enhanced-resolve": ["enhanced-resolve@5.20.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.0" } }, "sha512-Qohcme7V1inbAfvjItgw0EaxVX5q2rdVEZHRBrEQdRZTssLDGsL8Lwrznl8oQ/6kuTJONLaDcGjkNP247XEhcA=="],
|
||||
|
||||
"envinfo": ["envinfo@7.21.0", "", { "bin": { "envinfo": "dist/cli.js" } }, "sha512-Lw7I8Zp5YKHFCXL7+Dz95g4CcbMEpgvqZNNq3AmlT5XAV6CgAAk6gyAMqn2zjw08K9BHfcNuKrMiCPLByGafow=="],
|
||||
|
||||
"es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
|
||||
|
||||
"es-module-lexer": ["es-module-lexer@2.0.0", "", {}, "sha512-5POEcUuZybH7IdmGsD8wlf0AI55wMecM9rVBTI/qEAy2c1kTOm3DjFYjrBdI2K3BaJjJYfYFeRtM0t9ssnRuxw=="],
|
||||
|
||||
"escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
|
||||
|
||||
"eslint-scope": ["eslint-scope@5.1.1", "", { "dependencies": { "esrecurse": "^4.3.0", "estraverse": "^4.1.1" } }, "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw=="],
|
||||
|
||||
"esrecurse": ["esrecurse@4.3.0", "", { "dependencies": { "estraverse": "^5.2.0" } }, "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag=="],
|
||||
|
||||
"estraverse": ["estraverse@4.3.0", "", {}, "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw=="],
|
||||
|
||||
"events": ["events@3.3.0", "", {}, "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q=="],
|
||||
|
||||
"fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="],
|
||||
|
||||
"fast-glob": ["fast-glob@3.3.3", "", { "dependencies": { "@nodelib/fs.stat": "^2.0.2", "@nodelib/fs.walk": "^1.2.3", "glob-parent": "^5.1.2", "merge2": "^1.3.0", "micromatch": "^4.0.8" } }, "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg=="],
|
||||
|
||||
"fast-uri": ["fast-uri@3.1.0", "", {}, "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA=="],
|
||||
|
||||
"fastest-levenshtein": ["fastest-levenshtein@1.0.16", "", {}, "sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg=="],
|
||||
|
||||
"fastq": ["fastq@1.20.1", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw=="],
|
||||
|
||||
"fill-range": ["fill-range@7.1.1", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],
|
||||
|
||||
"find-up": ["find-up@4.1.0", "", { "dependencies": { "locate-path": "^5.0.0", "path-exists": "^4.0.0" } }, "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw=="],
|
||||
|
||||
"flat": ["flat@5.0.2", "", { "bin": { "flat": "cli.js" } }, "sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ=="],
|
||||
|
||||
"function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="],
|
||||
|
||||
"glob-parent": ["glob-parent@6.0.2", "", { "dependencies": { "is-glob": "^4.0.3" } }, "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A=="],
|
||||
|
||||
"glob-to-regexp": ["glob-to-regexp@0.4.1", "", {}, "sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw=="],
|
||||
|
||||
"globby": ["globby@14.1.0", "", { "dependencies": { "@sindresorhus/merge-streams": "^2.1.0", "fast-glob": "^3.3.3", "ignore": "^7.0.3", "path-type": "^6.0.0", "slash": "^5.1.0", "unicorn-magic": "^0.3.0" } }, "sha512-0Ia46fDOaT7k4og1PDW4YbodWWr3scS2vAr2lTbsplOt2WkKp0vQbkI9wKis/T5LV/dqPjO3bpS/z6GTJB82LA=="],
|
||||
|
||||
"graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
|
||||
|
||||
"has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
|
||||
|
||||
"hasown": ["hasown@2.0.2", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ=="],
|
||||
|
||||
"ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
|
||||
|
||||
"import-local": ["import-local@3.2.0", "", { "dependencies": { "pkg-dir": "^4.2.0", "resolve-cwd": "^3.0.0" }, "bin": { "import-local-fixture": "fixtures/cli.js" } }, "sha512-2SPlun1JUPWoM6t3F0dw0FkCF/jWY8kttcY4f599GLTSjh2OCuuhdTkJQsEcZzBqbXZGKMK2OqW1oZsjtf/gQA=="],
|
||||
|
||||
"interpret": ["interpret@3.1.1", "", {}, "sha512-6xwYfHbajpoF0xLW+iwLkhwgvLoZDfjYfoFNu8ftMoXINzwuymNLd9u/KmwtdT2GbR+/Cz66otEGEVVUHX9QLQ=="],
|
||||
|
||||
"is-core-module": ["is-core-module@2.16.1", "", { "dependencies": { "hasown": "^2.0.2" } }, "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w=="],
|
||||
|
||||
"is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="],
|
||||
|
||||
"is-glob": ["is-glob@4.0.3", "", { "dependencies": { "is-extglob": "^2.1.1" } }, "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg=="],
|
||||
|
||||
"is-number": ["is-number@7.0.0", "", {}, "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="],
|
||||
|
||||
"is-plain-object": ["is-plain-object@2.0.4", "", { "dependencies": { "isobject": "^3.0.1" } }, "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og=="],
|
||||
|
||||
"isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
|
||||
|
||||
"isobject": ["isobject@3.0.1", "", {}, "sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg=="],
|
||||
|
||||
"jest-worker": ["jest-worker@27.5.1", "", { "dependencies": { "@types/node": "*", "merge-stream": "^2.0.0", "supports-color": "^8.0.0" } }, "sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg=="],
|
||||
|
||||
"json-parse-even-better-errors": ["json-parse-even-better-errors@2.3.1", "", {}, "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w=="],
|
||||
|
||||
"json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
|
||||
|
||||
"kind-of": ["kind-of@6.0.3", "", {}, "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw=="],
|
||||
|
||||
"loader-runner": ["loader-runner@4.3.1", "", {}, "sha512-IWqP2SCPhyVFTBtRcgMHdzlf9ul25NwaFx4wCEH/KjAXuuHY4yNjvPXsBokp8jCB936PyWRaPKUNh8NvylLp2Q=="],
|
||||
|
||||
"locate-path": ["locate-path@5.0.0", "", { "dependencies": { "p-locate": "^4.1.0" } }, "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g=="],
|
||||
|
||||
"merge-stream": ["merge-stream@2.0.0", "", {}, "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w=="],
|
||||
|
||||
"merge2": ["merge2@1.4.1", "", {}, "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg=="],
|
||||
|
||||
"micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
|
||||
|
||||
"mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
|
||||
|
||||
"mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
|
||||
|
||||
"neo-async": ["neo-async@2.6.2", "", {}, "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw=="],
|
||||
|
||||
"node-releases": ["node-releases@2.0.37", "", {}, "sha512-1h5gKZCF+pO/o3Iqt5Jp7wc9rH3eJJ0+nh/CIoiRwjRxde/hAHyLPXYN4V3CqKAbiZPSeJFSWHmJsbkicta0Eg=="],
|
||||
|
||||
"normalize-path": ["normalize-path@3.0.0", "", {}, "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA=="],
|
||||
|
||||
"p-limit": ["p-limit@2.3.0", "", { "dependencies": { "p-try": "^2.0.0" } }, "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w=="],
|
||||
|
||||
"p-locate": ["p-locate@4.1.0", "", { "dependencies": { "p-limit": "^2.2.0" } }, "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A=="],
|
||||
|
||||
"p-try": ["p-try@2.2.0", "", {}, "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ=="],
|
||||
|
||||
"path-exists": ["path-exists@4.0.0", "", {}, "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w=="],
|
||||
|
||||
"path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
|
||||
|
||||
"path-parse": ["path-parse@1.0.7", "", {}, "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw=="],
|
||||
|
||||
"path-type": ["path-type@6.0.0", "", {}, "sha512-Vj7sf++t5pBD637NSfkxpHSMfWaeig5+DKWLhcqIYx6mWQz5hdJTGDVMQiJcw1ZYkhs7AazKDGpRVji1LJCZUQ=="],
|
||||
|
||||
"picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
|
||||
|
||||
"picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
|
||||
|
||||
"pkg-dir": ["pkg-dir@4.2.0", "", { "dependencies": { "find-up": "^4.0.0" } }, "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ=="],
|
||||
|
||||
"queue-microtask": ["queue-microtask@1.2.3", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="],
|
||||
|
||||
"randombytes": ["randombytes@2.1.0", "", { "dependencies": { "safe-buffer": "^5.1.0" } }, "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ=="],
|
||||
|
||||
"rechoir": ["rechoir@0.8.0", "", { "dependencies": { "resolve": "^1.20.0" } }, "sha512-/vxpCXddiX8NGfGO/mTafwjq4aFa/71pvamip0++IQk3zG8cbCj0fifNPrjjF1XMXUne91jL9OoxmdykoEtifQ=="],
|
||||
|
||||
"require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
|
||||
|
||||
"resolve": ["resolve@1.22.12", "", { "dependencies": { "es-errors": "^1.3.0", "is-core-module": "^2.16.1", "path-parse": "^1.0.7", "supports-preserve-symlinks-flag": "^1.0.0" }, "bin": { "resolve": "bin/resolve" } }, "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA=="],
|
||||
|
||||
"resolve-cwd": ["resolve-cwd@3.0.0", "", { "dependencies": { "resolve-from": "^5.0.0" } }, "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg=="],
|
||||
|
||||
"resolve-from": ["resolve-from@5.0.0", "", {}, "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw=="],
|
||||
|
||||
"reusify": ["reusify@1.1.0", "", {}, "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw=="],
|
||||
|
||||
"run-parallel": ["run-parallel@1.2.0", "", { "dependencies": { "queue-microtask": "^1.2.2" } }, "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA=="],
|
||||
|
||||
"safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
|
||||
|
||||
"schema-utils": ["schema-utils@4.3.3", "", { "dependencies": { "@types/json-schema": "^7.0.9", "ajv": "^8.9.0", "ajv-formats": "^2.1.1", "ajv-keywords": "^5.1.0" } }, "sha512-eflK8wEtyOE6+hsaRVPxvUKYCpRgzLqDTb8krvAsRIwOGlHoSgYLgBXoubGgLd2fT41/OUYdb48v4k4WWHQurA=="],
|
||||
|
||||
"semver": ["semver@7.7.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA=="],
|
||||
|
||||
"serialize-javascript": ["serialize-javascript@6.0.2", "", { "dependencies": { "randombytes": "^2.1.0" } }, "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g=="],
|
||||
|
||||
"shallow-clone": ["shallow-clone@3.0.1", "", { "dependencies": { "kind-of": "^6.0.2" } }, "sha512-/6KqX+GVUdqPuPPd2LxDDxzX6CAbjJehAAOKlNpqqUpAqPM6HeL8f+o3a+JsyGjn2lv0WY8UsTgUJjU9Ok55NA=="],
|
||||
|
||||
"shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
|
||||
|
||||
"shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
|
||||
|
||||
"slash": ["slash@5.1.0", "", {}, "sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg=="],
|
||||
|
||||
"source-map": ["source-map@0.7.6", "", {}, "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ=="],
|
||||
|
||||
"source-map-support": ["source-map-support@0.5.21", "", { "dependencies": { "buffer-from": "^1.0.0", "source-map": "^0.6.0" } }, "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w=="],
|
||||
|
||||
"supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
|
||||
|
||||
"supports-preserve-symlinks-flag": ["supports-preserve-symlinks-flag@1.0.0", "", {}, "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w=="],
|
||||
|
||||
"tapable": ["tapable@2.3.2", "", {}, "sha512-1MOpMXuhGzGL5TTCZFItxCc0AARf1EZFQkGqMm7ERKj8+Hgr5oLvJOVFcC+lRmR8hCe2S3jC4T5D7Vg/d7/fhA=="],
|
||||
|
||||
"terser": ["terser@5.46.1", "", { "dependencies": { "@jridgewell/source-map": "^0.3.3", "acorn": "^8.15.0", "commander": "^2.20.0", "source-map-support": "~0.5.20" }, "bin": { "terser": "bin/terser" } }, "sha512-vzCjQO/rgUuK9sf8VJZvjqiqiHFaZLnOiimmUuOKODxWL8mm/xua7viT7aqX7dgPY60otQjUotzFMmCB4VdmqQ=="],
|
||||
|
||||
"terser-webpack-plugin": ["terser-webpack-plugin@5.4.0", "", { "dependencies": { "@jridgewell/trace-mapping": "^0.3.25", "jest-worker": "^27.4.5", "schema-utils": "^4.3.0", "terser": "^5.31.1" }, "peerDependencies": { "webpack": "^5.1.0" } }, "sha512-Bn5vxm48flOIfkdl5CaD2+1CiUVbonWQ3KQPyP7/EuIl9Gbzq/gQFOzaMFUEgVjB1396tcK0SG8XcNJ/2kDH8g=="],
|
||||
|
||||
"to-regex-range": ["to-regex-range@5.0.1", "", { "dependencies": { "is-number": "^7.0.0" } }, "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ=="],
|
||||
|
||||
"ts-loader": ["ts-loader@9.5.7", "", { "dependencies": { "chalk": "^4.1.0", "enhanced-resolve": "^5.0.0", "micromatch": "^4.0.0", "semver": "^7.3.4", "source-map": "^0.7.4" }, "peerDependencies": { "typescript": "*", "webpack": "^5.0.0" } }, "sha512-/ZNrKgA3K3PtpMYOC71EeMWIloGw3IYEa5/t1cyz2r5/PyUwTXGzYJvcD3kfUvmhlfpz1rhV8B2O6IVTQ0avsg=="],
|
||||
|
||||
"typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
|
||||
|
||||
"undici-types": ["undici-types@7.19.2", "", {}, "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg=="],
|
||||
|
||||
"unicorn-magic": ["unicorn-magic@0.3.0", "", {}, "sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA=="],
|
||||
|
||||
"update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="],
|
||||
|
||||
"watchpack": ["watchpack@2.5.1", "", { "dependencies": { "glob-to-regexp": "^0.4.1", "graceful-fs": "^4.1.2" } }, "sha512-Zn5uXdcFNIA1+1Ei5McRd+iRzfhENPCe7LeABkJtNulSxjma+l7ltNx55BWZkRlwRnpOgHqxnjyaDgJnNXnqzg=="],
|
||||
|
||||
"webpack": ["webpack@5.106.1", "", { "dependencies": { "@types/eslint-scope": "^3.7.7", "@types/estree": "^1.0.8", "@types/json-schema": "^7.0.15", "@webassemblyjs/ast": "^1.14.1", "@webassemblyjs/wasm-edit": "^1.14.1", "@webassemblyjs/wasm-parser": "^1.14.1", "acorn": "^8.16.0", "acorn-import-phases": "^1.0.3", "browserslist": "^4.28.1", "chrome-trace-event": "^1.0.2", "enhanced-resolve": "^5.20.0", "es-module-lexer": "^2.0.0", "eslint-scope": "5.1.1", "events": "^3.2.0", "glob-to-regexp": "^0.4.1", "graceful-fs": "^4.2.11", "json-parse-even-better-errors": "^2.3.1", "loader-runner": "^4.3.1", "mime-types": "^2.1.27", "neo-async": "^2.6.2", "schema-utils": "^4.3.3", "tapable": "^2.3.0", "terser-webpack-plugin": "^5.3.17", "watchpack": "^2.5.1", "webpack-sources": "^3.3.4" }, "bin": { "webpack": "bin/webpack.js" } }, "sha512-EW8af29ak8Oaf4T8k8YsajjrDBDYgnKZ5er6ljWFJsXABfTNowQfvHLftwcepVgdz+IoLSdEAbBiM9DFXoll9w=="],
|
||||
|
||||
"webpack-cli": ["webpack-cli@5.1.4", "", { "dependencies": { "@discoveryjs/json-ext": "^0.5.0", "@webpack-cli/configtest": "^2.1.1", "@webpack-cli/info": "^2.0.2", "@webpack-cli/serve": "^2.0.5", "colorette": "^2.0.14", "commander": "^10.0.1", "cross-spawn": "^7.0.3", "envinfo": "^7.7.3", "fastest-levenshtein": "^1.0.12", "import-local": "^3.0.2", "interpret": "^3.1.1", "rechoir": "^0.8.0", "webpack-merge": "^5.7.3" }, "peerDependencies": { "webpack": "5.x.x" }, "bin": { "webpack-cli": "bin/cli.js" } }, "sha512-pIDJHIEI9LR0yxHXQ+Qh95k2EvXpWzZ5l+d+jIo+RdSm9MiHfzazIxwwni/p7+x4eJZuvG1AJwgC4TNQ7NRgsg=="],
|
||||
|
||||
"webpack-merge": ["webpack-merge@5.10.0", "", { "dependencies": { "clone-deep": "^4.0.1", "flat": "^5.0.2", "wildcard": "^2.0.0" } }, "sha512-+4zXKdx7UnO+1jaN4l2lHVD+mFvnlZQP/6ljaJVb4SZiwIKeUnrT5l0gkT8z+n4hKpC+jpOv6O9R+gLtag7pSA=="],
|
||||
|
||||
"webpack-sources": ["webpack-sources@3.3.4", "", {}, "sha512-7tP1PdV4vF+lYPnkMR0jMY5/la2ub5Fc/8VQrrU+lXkiM6C4TjVfGw7iKfyhnTQOsD+6Q/iKw0eFciziRgD58Q=="],
|
||||
|
||||
"which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
|
||||
|
||||
"wildcard": ["wildcard@2.0.1", "", {}, "sha512-CC1bOL87PIWSBhDcTrdeLo6eGT7mCFtrg0uIJtqJUFyK+eJnzl8A1niH56uu7KMa5XFrtiV+AQuHO3n7DsHnLQ=="],
|
||||
|
||||
"esrecurse/estraverse": ["estraverse@5.3.0", "", {}, "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA=="],
|
||||
|
||||
"fast-glob/glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
|
||||
|
||||
"jest-worker/supports-color": ["supports-color@8.1.1", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q=="],
|
||||
|
||||
"source-map-support/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
|
||||
|
||||
"terser/commander": ["commander@2.20.3", "", {}, "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="],
|
||||
}
|
||||
}
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 452 B After Width: | Height: | Size: 3.9 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 81 B After Width: | Height: | Size: 1.7 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 140 B After Width: | Height: | Size: 4.7 KiB |
30
extension/icons/relicario-logo.svg
Normal file
30
extension/icons/relicario-logo.svg
Normal file
@@ -0,0 +1,30 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" fill="none">
|
||||
<!-- ID card outer body -->
|
||||
<rect x="16" y="20" width="96" height="88" rx="6" fill="#0d1117" stroke="#58a6ff" stroke-width="3"/>
|
||||
|
||||
<!-- Photo rectangle (left side, dominant) -->
|
||||
<rect x="26" y="32" width="44" height="64" rx="2" fill="#58a6ff"/>
|
||||
|
||||
<!-- Silhouette in photo (cartoony connected portrait) -->
|
||||
<path d="M 28 96
|
||||
L 28 92
|
||||
C 28 84, 34 79, 42 77
|
||||
L 42 73
|
||||
C 38 71, 36 66, 36 60
|
||||
C 36 52, 41 46, 48 46
|
||||
C 55 46, 60 52, 60 60
|
||||
C 60 66, 58 71, 54 73
|
||||
L 54 77
|
||||
C 62 79, 68 84, 68 92
|
||||
L 68 96 Z" fill="#0d1117"/>
|
||||
|
||||
<!-- Info lines (right side, suggest text without being text) -->
|
||||
<rect x="78" y="36" width="24" height="4" rx="1" fill="#58a6ff"/>
|
||||
<rect x="78" y="48" width="20" height="3" rx="1" fill="#30363d"/>
|
||||
<rect x="78" y="56" width="24" height="3" rx="1" fill="#30363d"/>
|
||||
<rect x="78" y="64" width="18" height="3" rx="1" fill="#30363d"/>
|
||||
<!-- Lock icon (security indicator) -->
|
||||
<rect x="82" y="84" width="16" height="12" rx="1.5" fill="#3fb950"/>
|
||||
<path d="M85 84 V79 A5 5 0 0 1 95 79 V84" fill="none" stroke="#3fb950" stroke-width="2.5" stroke-linecap="round"/>
|
||||
<circle cx="90" cy="90" r="1.5" fill="#0d1117"/>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 1.3 KiB |
@@ -1,11 +1,16 @@
|
||||
{
|
||||
"manifest_version": 3,
|
||||
"name": "idfoto",
|
||||
"name": "relicario",
|
||||
"version": "0.1.0",
|
||||
"description": "Two-factor encrypted password manager",
|
||||
"icons": {
|
||||
"16": "icons/icon-16.png",
|
||||
"48": "icons/icon-48.png",
|
||||
"128": "icons/icon-128.png"
|
||||
},
|
||||
"browser_specific_settings": {
|
||||
"gecko": {
|
||||
"id": "idfoto@adlee.work",
|
||||
"id": "relicario@adlee.work",
|
||||
"strict_min_version": "128.0"
|
||||
}
|
||||
},
|
||||
@@ -31,6 +36,6 @@
|
||||
"extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
|
||||
},
|
||||
"web_accessible_resources": [{
|
||||
"resources": ["setup.html", "setup.js", "styles.css", "idfoto_wasm_bg.wasm", "idfoto_wasm.js"]
|
||||
"resources": ["setup.html", "setup.js", "styles.css", "relicario_wasm_bg.wasm", "relicario_wasm.js"]
|
||||
}]
|
||||
}
|
||||
|
||||
@@ -1,8 +1,13 @@
|
||||
{
|
||||
"manifest_version": 3,
|
||||
"name": "idfoto",
|
||||
"name": "relicario",
|
||||
"version": "0.1.0",
|
||||
"description": "Two-factor encrypted password manager",
|
||||
"icons": {
|
||||
"16": "icons/icon-16.png",
|
||||
"48": "icons/icon-48.png",
|
||||
"128": "icons/icon-128.png"
|
||||
},
|
||||
"permissions": ["storage", "activeTab", "clipboardWrite"],
|
||||
"host_permissions": ["<all_urls>"],
|
||||
"background": {
|
||||
@@ -26,7 +31,7 @@
|
||||
"extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
|
||||
},
|
||||
"web_accessible_resources": [{
|
||||
"resources": ["setup.html", "setup.js", "styles.css", "idfoto_wasm_bg.wasm", "idfoto_wasm.js"],
|
||||
"resources": ["setup.html", "setup.js", "styles.css", "relicario_wasm_bg.wasm", "relicario_wasm.js"],
|
||||
"matches": ["<all_urls>"]
|
||||
}]
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{
|
||||
"name": "idfoto-extension",
|
||||
"name": "relicario-extension",
|
||||
"version": "0.1.0",
|
||||
"private": true,
|
||||
"scripts": {
|
||||
@@ -8,7 +8,7 @@
|
||||
"build:all": "npm run build:wasm && npm run build && npm run build:firefox",
|
||||
"dev": "webpack --mode development --watch",
|
||||
"dev:firefox": "webpack --config webpack.firefox.config.js --mode development --watch",
|
||||
"build:wasm": "wasm-pack build ../crates/idfoto-wasm --target web --out-dir ../../extension/wasm"
|
||||
"build:wasm": "wasm-pack build ../crates/relicario-wasm --target web --out-dir ../../extension/wasm"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@types/chrome": "^0.1.40",
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>idfoto — vault setup</title>
|
||||
<title>relicario — vault setup</title>
|
||||
<link rel="stylesheet" href="styles.css">
|
||||
<style>
|
||||
body {
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
/// credentials in the vault. Supports bar and toast prompt styles.
|
||||
|
||||
import type { Request, Response } from '../shared/messages';
|
||||
import type { IdfotoSettings } from '../shared/types';
|
||||
import type { RelicarioSettings } from '../shared/types';
|
||||
|
||||
// --- State ---
|
||||
|
||||
@@ -89,8 +89,8 @@ async function onFormSubmit(pwField: HTMLInputElement): Promise<void> {
|
||||
|
||||
// Fetch settings for prompt style
|
||||
const settingsResp = await sendMessage({ type: 'get_settings' });
|
||||
const settings: IdfotoSettings = settingsResp.ok
|
||||
? (settingsResp.data as { settings: IdfotoSettings }).settings
|
||||
const settings: RelicarioSettings = settingsResp.ok
|
||||
? (settingsResp.data as { settings: RelicarioSettings }).settings
|
||||
: { captureEnabled: true, captureStyle: 'bar' };
|
||||
|
||||
showPrompt(settings.captureStyle, data.action, url, username, password, data.entryId);
|
||||
@@ -99,7 +99,7 @@ async function onFormSubmit(pwField: HTMLInputElement): Promise<void> {
|
||||
// --- Prompt UI ---
|
||||
|
||||
function removeExistingPrompt(): void {
|
||||
const existing = document.getElementById('idfoto-capture-prompt');
|
||||
const existing = document.getElementById('relicario-capture-prompt');
|
||||
if (existing) existing.remove();
|
||||
}
|
||||
|
||||
@@ -121,7 +121,7 @@ function showPrompt(
|
||||
}
|
||||
|
||||
const container = document.createElement('div');
|
||||
container.id = 'idfoto-capture-prompt';
|
||||
container.id = 'relicario-capture-prompt';
|
||||
|
||||
// Common styles
|
||||
const baseStyles = [
|
||||
@@ -173,17 +173,17 @@ function showPrompt(
|
||||
<span style="flex:1; overflow:hidden; text-overflow:ellipsis; white-space:nowrap;">
|
||||
${actionLabel} login for <strong style="color:#58a6ff">${escapeForHtml(hostname)}</strong>${escapeForHtml(displayUser)}?
|
||||
</span>
|
||||
<button id="idfoto-save-btn" style="
|
||||
<button id="relicario-save-btn" style="
|
||||
background:#1f6feb; color:#fff; border:none; padding:5px 14px;
|
||||
border-radius:3px; cursor:pointer; font-family:inherit; font-size:12px;
|
||||
white-space:nowrap;
|
||||
">${actionLabel}</button>
|
||||
<button id="idfoto-never-btn" style="
|
||||
<button id="relicario-never-btn" style="
|
||||
background:transparent; color:#8b949e; border:1px solid #30363d;
|
||||
padding:5px 10px; border-radius:3px; cursor:pointer;
|
||||
font-family:inherit; font-size:12px; white-space:nowrap;
|
||||
">Never</button>
|
||||
<button id="idfoto-close-btn" style="
|
||||
<button id="relicario-close-btn" style="
|
||||
background:transparent; color:#8b949e; border:none;
|
||||
cursor:pointer; font-size:16px; padding:2px 6px;
|
||||
font-family:inherit; line-height:1;
|
||||
@@ -212,7 +212,7 @@ function showPrompt(
|
||||
};
|
||||
|
||||
// Save button
|
||||
container.querySelector('#idfoto-save-btn')?.addEventListener('click', async () => {
|
||||
container.querySelector('#relicario-save-btn')?.addEventListener('click', async () => {
|
||||
clearAutoDismiss();
|
||||
|
||||
const now = new Date().toISOString();
|
||||
@@ -246,22 +246,22 @@ function showPrompt(
|
||||
// Show confirmation
|
||||
const span = container.querySelector('span');
|
||||
if (span) span.textContent = '\u2713 Saved';
|
||||
const saveBtn = container.querySelector('#idfoto-save-btn') as HTMLElement | null;
|
||||
const neverBtn = container.querySelector('#idfoto-never-btn') as HTMLElement | null;
|
||||
const saveBtn = container.querySelector('#relicario-save-btn') as HTMLElement | null;
|
||||
const neverBtn = container.querySelector('#relicario-never-btn') as HTMLElement | null;
|
||||
if (saveBtn) saveBtn.style.display = 'none';
|
||||
if (neverBtn) neverBtn.style.display = 'none';
|
||||
setTimeout(() => removeExistingPrompt(), 1500);
|
||||
});
|
||||
|
||||
// Never button
|
||||
container.querySelector('#idfoto-never-btn')?.addEventListener('click', async () => {
|
||||
container.querySelector('#relicario-never-btn')?.addEventListener('click', async () => {
|
||||
clearAutoDismiss();
|
||||
await sendMessage({ type: 'blacklist_site', hostname });
|
||||
removeExistingPrompt();
|
||||
});
|
||||
|
||||
// Close button
|
||||
container.querySelector('#idfoto-close-btn')?.addEventListener('click', () => {
|
||||
container.querySelector('#relicario-close-btn')?.addEventListener('click', () => {
|
||||
clearAutoDismiss();
|
||||
removeExistingPrompt();
|
||||
});
|
||||
|
||||
@@ -21,7 +21,7 @@ export function injectFieldIcons(
|
||||
const icon = document.createElement('div');
|
||||
icon.textContent = 'id';
|
||||
icon.setAttribute('role', 'button');
|
||||
icon.setAttribute('aria-label', 'idfoto autofill');
|
||||
icon.setAttribute('aria-label', 'relicario autofill');
|
||||
|
||||
Object.assign(icon.style, {
|
||||
position: 'absolute',
|
||||
@@ -98,10 +98,10 @@ function showPicker(
|
||||
candidates: Array<[string, ManifestEntry]>,
|
||||
): void {
|
||||
// Remove any existing picker.
|
||||
document.querySelectorAll('.idfoto-picker').forEach(el => el.remove());
|
||||
document.querySelectorAll('.relicario-picker').forEach(el => el.remove());
|
||||
|
||||
const picker = document.createElement('div');
|
||||
picker.className = 'idfoto-picker';
|
||||
picker.className = 'relicario-picker';
|
||||
Object.assign(picker.style, {
|
||||
position: 'absolute',
|
||||
right: '0',
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/// Settings view — capture toggle, prompt style, and blacklist management.
|
||||
|
||||
import { sendMessage, navigate, escapeHtml } from '../popup';
|
||||
import type { IdfotoSettings } from '../../shared/types';
|
||||
import type { RelicarioSettings } from '../../shared/types';
|
||||
|
||||
export async function renderSettings(app: HTMLElement): Promise<void> {
|
||||
app.innerHTML = '<div class="pad" style="text-align:center; padding-top:20px;"><span class="spinner"></span></div>';
|
||||
@@ -12,8 +12,8 @@ export async function renderSettings(app: HTMLElement): Promise<void> {
|
||||
sendMessage({ type: 'get_blacklist' }),
|
||||
]);
|
||||
|
||||
const settings: IdfotoSettings = settingsResp.ok
|
||||
? (settingsResp.data as { settings: IdfotoSettings }).settings
|
||||
const settings: RelicarioSettings = settingsResp.ok
|
||||
? (settingsResp.data as { settings: RelicarioSettings }).settings
|
||||
: { captureEnabled: false, captureStyle: 'bar' };
|
||||
|
||||
const blacklist: string[] = blacklistResp.ok
|
||||
@@ -24,7 +24,7 @@ export async function renderSettings(app: HTMLElement): Promise<void> {
|
||||
? blacklist.map((h) => `
|
||||
<div style="display:flex; align-items:center; justify-content:space-between; padding:4px 0; border-bottom:1px solid #21262d;">
|
||||
<span style="font-size:12px; overflow:hidden; text-overflow:ellipsis;">${escapeHtml(h)}</span>
|
||||
<button class="idfoto-remove-bl" data-hostname="${escapeHtml(h)}" style="
|
||||
<button class="relicario-remove-bl" data-hostname="${escapeHtml(h)}" style="
|
||||
background:transparent; color:#f85149; border:none; cursor:pointer;
|
||||
font-size:11px; padding:2px 6px;
|
||||
">remove</button>
|
||||
@@ -86,7 +86,7 @@ export async function renderSettings(app: HTMLElement): Promise<void> {
|
||||
});
|
||||
|
||||
// Blacklist remove buttons
|
||||
document.querySelectorAll('.idfoto-remove-bl').forEach((btn) => {
|
||||
document.querySelectorAll('.relicario-remove-bl').forEach((btn) => {
|
||||
btn.addEventListener('click', async () => {
|
||||
const hostname = (btn as HTMLElement).dataset.hostname;
|
||||
if (hostname) {
|
||||
|
||||
@@ -9,7 +9,8 @@ import { escapeHtml } from '../popup';
|
||||
export function renderSetupWizard(app: HTMLElement): void {
|
||||
app.innerHTML = `
|
||||
<div class="pad" style="padding-top:24px;text-align:center;">
|
||||
<div class="brand" style="font-size:16px;margin-bottom:4px;">idfoto</div>
|
||||
<img class="brand-logo" src="icons/relicario-logo.svg" alt="">
|
||||
<div class="brand" style="font-size:16px;margin-bottom:4px;">relicario</div>
|
||||
<p class="secondary" style="margin-bottom:20px;">two-factor vault</p>
|
||||
|
||||
<p class="muted" style="margin-bottom:16px;font-size:11px;line-height:1.6;">
|
||||
|
||||
@@ -8,7 +8,8 @@ export function renderUnlock(app: HTMLElement): void {
|
||||
|
||||
app.innerHTML = `
|
||||
<div class="pad" style="text-align:center; padding-top:40px;">
|
||||
<div class="brand">idfoto</div>
|
||||
<img class="brand-logo" src="icons/relicario-logo.svg" alt="">
|
||||
<div class="brand">relicario</div>
|
||||
<p class="muted" style="margin:8px 0 24px;">two-factor vault</p>
|
||||
<div class="form-group">
|
||||
<input
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=360">
|
||||
<link rel="stylesheet" href="styles.css">
|
||||
<title>idfoto</title>
|
||||
<title>relicario</title>
|
||||
</head>
|
||||
<body>
|
||||
<div id="app"></div>
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/* idfoto extension — terminal dark theme */
|
||||
/* relicario extension — terminal dark theme */
|
||||
|
||||
* {
|
||||
margin: 0;
|
||||
@@ -39,6 +39,13 @@ body {
|
||||
letter-spacing: 1px;
|
||||
}
|
||||
|
||||
.brand-logo {
|
||||
display: block;
|
||||
width: 48px;
|
||||
height: 48px;
|
||||
margin: 0 auto 8px;
|
||||
}
|
||||
|
||||
.label {
|
||||
font-size: 11px;
|
||||
font-weight: 600;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/// Background script entry point for the idfoto browser extension.
|
||||
/// Background script entry point for the relicario browser extension.
|
||||
///
|
||||
/// In Chrome this runs as a service worker (MV3). In Firefox this runs
|
||||
/// as a persistent background script. WASM loading adapts automatically.
|
||||
@@ -7,7 +7,7 @@
|
||||
/// and routes all messages from the popup and content scripts.
|
||||
|
||||
import type { Request, Response } from '../shared/messages';
|
||||
import type { Manifest, VaultConfig, SetupState, IdfotoSettings } from '../shared/types';
|
||||
import type { Manifest, VaultConfig, SetupState, RelicarioSettings } from '../shared/types';
|
||||
import { DEFAULT_SETTINGS } from '../shared/types';
|
||||
import type { GitHost } from './git-host';
|
||||
import { createGitHost } from './git-host';
|
||||
@@ -30,9 +30,9 @@ const totpSecretCache: Map<string, string> = new Map();
|
||||
// We detect the environment at runtime and use the appropriate loading strategy.
|
||||
|
||||
// @ts-ignore TS2307 — resolved by webpack alias / copy
|
||||
import initDefault, { initSync } from '../../wasm/idfoto_wasm.js';
|
||||
import initDefault, { initSync } from '../../wasm/relicario_wasm.js';
|
||||
// @ts-ignore TS2307
|
||||
import * as wasmBindings from '../../wasm/idfoto_wasm.js';
|
||||
import * as wasmBindings from '../../wasm/relicario_wasm.js';
|
||||
|
||||
type WasmModule = typeof wasmBindings;
|
||||
let wasm: WasmModule | null = null;
|
||||
@@ -47,12 +47,12 @@ async function initWasm(): Promise<WasmModule> {
|
||||
|
||||
if (isServiceWorker) {
|
||||
// Chrome: fetch WASM binary and instantiate synchronously
|
||||
const wasmResponse = await fetch(chrome.runtime.getURL('idfoto_wasm_bg.wasm'));
|
||||
const wasmResponse = await fetch(chrome.runtime.getURL('relicario_wasm_bg.wasm'));
|
||||
const wasmBytes = await wasmResponse.arrayBuffer();
|
||||
initSync({ module: new WebAssembly.Module(wasmBytes) });
|
||||
} else {
|
||||
// Firefox: background script — async init works
|
||||
const wasmUrl = chrome.runtime.getURL('idfoto_wasm_bg.wasm');
|
||||
const wasmUrl = chrome.runtime.getURL('relicario_wasm_bg.wasm');
|
||||
await initDefault(wasmUrl);
|
||||
}
|
||||
|
||||
@@ -86,13 +86,13 @@ async function loadSetupState(): Promise<SetupState> {
|
||||
|
||||
// --- Settings & blacklist helpers ---
|
||||
|
||||
async function loadSettings(): Promise<IdfotoSettings> {
|
||||
const result = await chrome.storage.local.get('idfotoSettings');
|
||||
return (result.idfotoSettings as IdfotoSettings) ?? { ...DEFAULT_SETTINGS };
|
||||
async function loadSettings(): Promise<RelicarioSettings> {
|
||||
const result = await chrome.storage.local.get('relicarioSettings');
|
||||
return (result.relicarioSettings as RelicarioSettings) ?? { ...DEFAULT_SETTINGS };
|
||||
}
|
||||
|
||||
async function saveSettings(settings: IdfotoSettings): Promise<void> {
|
||||
await chrome.storage.local.set({ idfotoSettings: settings });
|
||||
async function saveSettings(settings: RelicarioSettings): Promise<void> {
|
||||
await chrome.storage.local.set({ relicarioSettings: settings });
|
||||
}
|
||||
|
||||
async function loadBlacklist(): Promise<string[]> {
|
||||
|
||||
@@ -30,8 +30,8 @@ export interface VaultMeta {
|
||||
|
||||
/// Read the vault salt and KDF params from the git repo.
|
||||
export async function fetchVaultMeta(git: GitHost): Promise<VaultMeta> {
|
||||
const saltBytes = await git.readFile('.idfoto/salt');
|
||||
const paramsRaw = await git.readFile('.idfoto/params.json');
|
||||
const saltBytes = await git.readFile('.relicario/salt');
|
||||
const paramsRaw = await git.readFile('.relicario/params.json');
|
||||
const paramsJson = new TextDecoder().decode(paramsRaw);
|
||||
return { salt: saltBytes, paramsJson };
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/// Vault initialization wizard — 4-step flow for creating new idfoto vaults.
|
||||
/// Vault initialization wizard — 4-step flow for creating new relicario vaults.
|
||||
///
|
||||
/// Step 1: Choose host type (Gitea / GitHub)
|
||||
/// Step 2: Configure connection (URL, repo, token) + test
|
||||
@@ -11,16 +11,16 @@ import type { VaultConfig } from '../shared/types';
|
||||
|
||||
// --- WASM module (loaded dynamically) ---
|
||||
|
||||
type WasmModule = typeof import('idfoto-wasm');
|
||||
type WasmModule = typeof import('relicario-wasm');
|
||||
let wasm: WasmModule | null = null;
|
||||
|
||||
async function loadWasm(): Promise<WasmModule> {
|
||||
if (wasm) return wasm;
|
||||
const mod = await import(
|
||||
// @ts-ignore TS2307 — resolved at runtime, not by TS/webpack
|
||||
/* webpackIgnore: true */ '../idfoto_wasm.js'
|
||||
/* webpackIgnore: true */ '../relicario_wasm.js'
|
||||
) as WasmModule & { default: (input?: string | URL) => Promise<void> };
|
||||
await mod.default('../idfoto_wasm_bg.wasm');
|
||||
await mod.default('../relicario_wasm_bg.wasm');
|
||||
wasm = mod;
|
||||
return mod;
|
||||
}
|
||||
@@ -109,7 +109,8 @@ function render(): void {
|
||||
|
||||
app.innerHTML = `
|
||||
<div class="pad" style="padding-top:12px;">
|
||||
<div class="brand" style="margin-bottom:4px;">idfoto vault setup</div>
|
||||
<img class="brand-logo" src="icons/relicario-logo.svg" alt="" style="margin-bottom:12px;">
|
||||
<div class="brand" style="margin-bottom:4px;">relicario vault setup</div>
|
||||
${progressHtml}
|
||||
${state.error ? `<div class="error">${escapeHtml(state.error)}</div>` : ''}
|
||||
${stepHtml}
|
||||
@@ -411,14 +412,14 @@ function attachStep3(): void {
|
||||
const host = createGitHost(state.hostType, hostUrl, state.repoPath, state.apiToken);
|
||||
|
||||
await host.writeFile(
|
||||
'.idfoto/salt',
|
||||
'.relicario/salt',
|
||||
salt,
|
||||
'init: vault salt',
|
||||
);
|
||||
|
||||
const paramsBytes = new TextEncoder().encode(paramsJson);
|
||||
await host.writeFile(
|
||||
'.idfoto/params.json',
|
||||
'.relicario/params.json',
|
||||
paramsBytes,
|
||||
'init: KDF parameters',
|
||||
);
|
||||
@@ -426,7 +427,7 @@ function attachStep3(): void {
|
||||
const devicesJson = '{"devices":[]}';
|
||||
const devicesBytes = new TextEncoder().encode(devicesJson);
|
||||
await host.writeFile(
|
||||
'.idfoto/devices.json',
|
||||
'.relicario/devices.json',
|
||||
devicesBytes,
|
||||
'init: device registry',
|
||||
);
|
||||
|
||||
@@ -23,7 +23,7 @@ export type Request =
|
||||
| { type: 'check_credential'; url: string; username: string; password: string }
|
||||
| { type: 'blacklist_site'; hostname: string }
|
||||
| { type: 'get_settings' }
|
||||
| { type: 'update_settings'; settings: Partial<import('./types').IdfotoSettings> }
|
||||
| { type: 'update_settings'; settings: Partial<import('./types').RelicarioSettings> }
|
||||
| { type: 'get_blacklist' }
|
||||
| { type: 'remove_blacklist'; hostname: string };
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/// Full credential entry (matches Rust Entry struct in idfoto-core).
|
||||
/// Full credential entry (matches Rust Entry struct in relicario-core).
|
||||
export interface Entry {
|
||||
name: string;
|
||||
url?: string;
|
||||
@@ -42,12 +42,12 @@ export interface SetupState {
|
||||
}
|
||||
|
||||
/// User-configurable credential capture settings.
|
||||
export interface IdfotoSettings {
|
||||
export interface RelicarioSettings {
|
||||
captureEnabled: boolean;
|
||||
captureStyle: 'bar' | 'toast';
|
||||
}
|
||||
|
||||
export const DEFAULT_SETTINGS: IdfotoSettings = {
|
||||
export const DEFAULT_SETTINGS: RelicarioSettings = {
|
||||
captureEnabled: false,
|
||||
captureStyle: 'bar',
|
||||
};
|
||||
|
||||
4
extension/src/wasm.d.ts
vendored
4
extension/src/wasm.d.ts
vendored
@@ -1,9 +1,9 @@
|
||||
/// Type declarations for the idfoto WASM module produced by wasm-pack.
|
||||
/// Type declarations for the relicario WASM module produced by wasm-pack.
|
||||
|
||||
// Ambient module declarations for the WASM glue code.
|
||||
// The module specifier must exactly match what's used in import statements.
|
||||
|
||||
declare module 'idfoto-wasm' {
|
||||
declare module 'relicario-wasm' {
|
||||
export default function init(input?: string | URL): Promise<void>;
|
||||
export function derive_master_key(
|
||||
passphrase: string,
|
||||
|
||||
@@ -10,7 +10,7 @@
|
||||
"sourceMap": true,
|
||||
"lib": ["ES2022", "DOM", "DOM.Iterable"],
|
||||
"paths": {
|
||||
"idfoto-wasm": ["./wasm/idfoto_wasm.js"]
|
||||
"relicario-wasm": ["./wasm/relicario_wasm.js"]
|
||||
},
|
||||
"baseUrl": "."
|
||||
},
|
||||
|
||||
@@ -27,8 +27,8 @@ module.exports = {
|
||||
{ from: 'src/popup/styles.css', to: 'styles.css' },
|
||||
{ from: 'setup.html', to: '.' },
|
||||
{ from: 'icons', to: 'icons' },
|
||||
{ from: 'wasm/idfoto_wasm_bg.wasm', to: '.' },
|
||||
{ from: 'wasm/idfoto_wasm.js', to: '.' },
|
||||
{ from: 'wasm/relicario_wasm_bg.wasm', to: '.' },
|
||||
{ from: 'wasm/relicario_wasm.js', to: '.' },
|
||||
],
|
||||
}),
|
||||
],
|
||||
|
||||
@@ -27,8 +27,8 @@ module.exports = {
|
||||
{ from: 'src/popup/styles.css', to: 'styles.css' },
|
||||
{ from: 'setup.html', to: '.' },
|
||||
{ from: 'icons', to: 'icons' },
|
||||
{ from: 'wasm/idfoto_wasm_bg.wasm', to: '.' },
|
||||
{ from: 'wasm/idfoto_wasm.js', to: '.' },
|
||||
{ from: 'wasm/relicario_wasm_bg.wasm', to: '.' },
|
||||
{ from: 'wasm/relicario_wasm.js', to: '.' },
|
||||
],
|
||||
}),
|
||||
],
|
||||
|
||||
Reference in New Issue
Block a user